O'Reilly logo

Mastering Windows Network Forensics and Investigation, 2nd Edition by Scott Pearson, Ryan Johnson, Steve Bunting, Steven Anson

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Compensating for Time Zone Offsets

As mentioned in Chapter 7, “Windows Filesystems,” the NTFS filesystem stores time stamps in UTC (Universal Time), which is also Greenwich Mean Time (GMT). When time is displayed to the user, it is displayed in the local time based on the time zone offset on the computer. When a local time is stored on the computer, the difference between local time and UTC is computed, and the time is stored in UTC. The local time zone offset is determined by settings in the registry. If you want to examine the machine within the context of its local time, you need to know what those settings are. The time zone offset information is stored in the TimeZoneInformation key. Here’s the full path:

HKLM\SYSTEM\CurrentControlSet\Control\ ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required