A good question that was brought up at the presentation was about changing times/rearranging times for time events that have been tampered with. This functionality would require some sort of audit trail to accompany it. An audit trail would need to be sufficiently detailed to allow backtracking the event to its original values. The idea of using sources from multiple hosts might need this for synchronization because the imported times may be altered to fit the timeline. A change like this should be recorded.