Electronic Control Units, like any embedded microprocessor based device, can have a real-time clock. This clock is designed to count time from an agreed upon epoch. For example, the SAE J1587 standard defines the epoch to be Jan 1, 1985 at midnight UTC. Since the counting ability of a processor depends on clock stability and clock stability depends on a crystal oscillator. While these devices are pretty good, they are not perfect, as such, real time clocks on embedded device will drift. The drift can be assumed linear, so if there are two known points, the amount of drift is quantifiable as the slope of the line connecting those two times and time difference.
This method, of course, depends on having a reference time. There a few consistent references for time. The first and most common, is to use a network time protocol and query a time server on the internet. Many companies and organizations maintain time servers. The other option for getting time is by interpreting the time stamp from the NMEA standardized sentence from a GPS module. GPS systems maintain very precise timing, which can be relied upon for many things. However, achieving sub second synchronization is difficult.
The timing data from a DDEC or Caterpillar ECM have drift, but the drift is pretty small (measured in seconds per day), which means the time reported on the ECM incident records can be compared to the PC time for a difference. If this examination is done within a few days, difference at the time of the examination can inferred to be the same at the time of the incident. If the drift is suspected, then a linear interpolation or extrapolation will provide a good estimate of the actual difference between the PC time and the ECM time.