- mscotgrove

You said other files were closer to 1 hour different.

Was this in UK in the summer, ie is one displaying GMT and other BST?

Am I correct that FAT32 does not have a time zone flag? (My personal time zone flag says it is too late at night to check carefully!!)

No, the device was in the United States, and did not travel between two time zones.

FAT32 does not have any sort of mechanism for tracking time zones. The time is stored as local time, whatever that might be on the devices clock.  

twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

- trewmte

twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.

Is there a reference for this? I'd like to add it to my reference material.  

- trewmte

twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.

Can you please explain this more?

I do have the device, but I am hesitant to manipulate it unless absolutely needed.p  

This is where I first read about conflicting date and time stamps

www.blackberryforums.c...phone.html

www.blackberryforums.c...one-2.html



I also noted this 2010 question on my search:

www.blackberryforums.c...-exif.html
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

- trewmte

This is where I first read about conflicting date and time stamps

www.blackberryforums.c...phone.html

www.blackberryforums.c...one-2.html



I also noted this 2010 question on my search:

www.blackberryforums.c...-exif.html

Very illuminating. I shall follow up on this. It appears to be the case, but the time variance they mention aren't as great as some of mine. But, I should be able to prove/disprove based on if the time for one photo is wrong, and the subsequent photos taken right after are right.

Thank you for finding this.  

So it is a known issue for the BlackBerry Bold, 8310, 8330 at least, and it has to do with security lock-out.

It appears from the blog write up that at least this is caused by a "frozen EXIF date/time stamp" for the first image after unlock.

That is -
Clock correct in BB
Clock correct in EXIF date/time stamp variable
BB security locks (manual or timeout)
time passes
BB clock updates
EXIF date/time stamp variable stores date/time at time of screen lock and is not updated
BB security unlocks
first picture uses wrong/old at-security-lock date/time for EXIF in image
BB clock updates
EXIF date/time variable updates to correct date/time
all following uses correct date/time

Do I have it correctly?

(corrected link)  

Last edited by jhup on Wed Dec 05, 2012 2:00 pm; edited 1 time in total