(rough notes that need expanding)
Assumes Eve can't watch.
SystemTIME a structure of words with current date-time to milliseconds,
timer a 8 byte floating point number with the count of hundredths of seconds since midnight.
GETTICKCOUNT function dword (32 bits) with count of milliseconds since system start. Changes in
step with real time, but eve should not know closely when startup/reboot was; else see Rule 3.
GETSYSTEMTIMES count of 100nS in 8bytes since system start for idle time, kernal time and user
time. Win XP SP1 and later. If Eve knows this Rule 3.
Disk Usage As A Source
CPU usage As A Source