Prerequisites for trustworthy evidence include UTC sync. The firewall clock is four minutes fast and the database clock is six minutes slow. Reconstructing whether data exfiltration happened before or after a token revocation becomes impossible. Synchronize each clock to an authenticated Network Time Protocol (NTP) source and log in UTC.