Why do we care about timestamps embedded in UUIDs?

A UUIDv1 timestamp often correlates with when the object it represents was created. Extracting this timestamp gives us another point in our timeline (or just more context).

For example, the timestamp from the UUID in this GitHub image = time of image upload ⏰

Unfurl: https://dfir.blog/unfurl/?url=https://repository-images.githubusercontent.com/219613650/92534a80-17ab-11ea-9217-fe06f144cdb2?width=441&height=110

#DFIR #OSINT #Unfurl