±Forensic Focus Partners
|New Today: 0||Overall: 29236|
|New Yesterday: 4||Visitors: 118|
· SADFE 2015 – Malaga 30th September – 2nd October
· Countering Anti-Forensic Efforts – Part 2
· Windows 8 Touch Keyboard Forensics
· Countering Anti-Forensic Efforts – Part 1
· Linux Timestamps, Oh boy!
· Standard Processes in Windows 10
· NAS Forensics Explained
· Project Spartan Forensics
· FT Cyber Security Summit Europe – London 22nd September
Forensics near the International Date Line
I've just examined the 2013 amendment of ISO-9660, and noted that it did not introduce any changes to the time stamp format, which allows timestamps to include a time zone offset between -12 and +13 hours.
However, in 1995 the time offset UTC+14 was introduced in parts of Kiribati (south of Hawaii) -- so any ISO-9660 CD-Rs created there would either have to break ISO-9660 or handle time stamps in some other way.
A curious thing is that Windows 7 does not appear to have any support for this time zone, nor does Mac OS X. It probably isn't a major market, still it is strange to find it unaccounted for. IANA Time Zone database includes it as Pacific/Kirimati, but it is missing from some other sources as the Unicode CLDR of Windows time zones.
This appears to produce an interesting (well, in my eyes ... ) challenge to computer forensic-related work, particularly for 'local' time stamps.
Does anyone know anything about computer forensics in this or neighbouring areas? What problems does the apparent lack of time zone support introduce, and how are they overcome -- use of Zulu time throughout?
- Senior Member
- forveuxSo would it solely affect work in the....+14 time zone?
I think so ...
My first question was based on the IANA Pacific/Kiritimati time zone specification. I've noted since that the CIA World Factbook does not mention +14 in conjunction with Kiribati/Line Islands. That could explain why it's not supported by Windows.
On the other hand, HM Nautical Almanac says +14 (based on their web site).
- Senior Member