As part of tamper detection the RTC can capture the counter value (COUNT/CLOCK) into the 32-bit TIMESTAMP register.

Three CLK_RTC periods are required to detect the tampering condition and capture the value. The TIMESTAMP value can be read once the Tamper flag is set in the Interrupt Flag register (INTFLAG.TAMPER). If the DMA Enable bit in the Control B register is one (CTRLB.DMAEN), a DMA request will be triggered by the timestamp. In order to determine which tamper source caused a capture, the Tamper ID register (TAMPID) provides the detection status of each input pin and the input event. A DMA transfer can then read both TIMESTAMP and TAMPID in succession.

A new timestamp value cannot be captured until the Tamper flag is cleared, either by reading the timestamp or by writing a one to INTFLAG.TAMPER. If several tamper conditions occur in a short window before the flag is cleared, only the first timestamp may be logged. However, the detection of each tamper will still be recorded in TAMPID.

The Tamper Input Event (TAMPEVT) will always perform a timestamp capture. To capture on the external inputs (IN0n), the corresponding Input Action field in the Tamper Control register (TAMPCTRL.IN0nACT) must be written to one. If the input is set for wake functionality, they do not capture the timestamp; however, the Tamper flag and TAMPID will still be updated.