A system administrator is responding to a legal order to turn over all logs from all company servers. The system administrator records the system time of all servers to ensure that:

HDD hashes verify the integrity of disk images and are unrelated to recording system time.

Verifying NTP server functionality is a network maintenance concern, not the purpose of recording system time during evidence collection.

Chain of custody refers to the documented handling and transfer of evidence, not to the act of recording server system times.

Different servers may have their clocks set incorrectly or drifted from standard time. By documenting each server's system time at the moment of collection, investigators can calculate the offset from a reference time (such as UTC or an NTP source) and accurately reconstruct the true sequence of events across all collected logs.