±Forensic Focus Partners
New Today: 0
New Yesterday: 0
±Forensic Focus Partner Links
· Forensic Analysis of SQLite Databases: Free Lists, Write Ahead Log, Unallocated Space and Carving
· How Secure Is Your Password? A Friendly Advice from a Company That Breaks Passwords
· Using SQL as a date/time conversion tool
· Forensics and Bitcoin
· Investigation and Intelligence Framework (IIF) – an evidence extraction model for investigation
· Extracting data from dump of mobile devices running Android operating system
· Development of Digital Forensic Tools on Mobile Device, a Potential Area to Consider?
· Can You Get That License Plate?
· How To Decrypt WeChat EnMicroMsg.db Database?
Forensics near the International Date Line
I've just examined the 2013 amendment of ISO-9660, and noted that it did not introduce any changes to the time stamp format, which allows timestamps to include a time zone offset between -12 and +13 hours.
However, in 1995 the time offset UTC+14 was introduced in parts of Kiribati (south of Hawaii) -- so any ISO-9660 CD-Rs created there would either have to break ISO-9660 or handle time stamps in some other way.
A curious thing is that Windows 7 does not appear to have any support for this time zone, nor does Mac OS X. It probably isn't a major market, still it is strange to find it unaccounted for. IANA Time Zone database includes it as Pacific/Kirimati, but it is missing from some other sources as the Unicode CLDR of Windows time zones.
This appears to produce an interesting (well, in my eyes ... ) challenge to computer forensic-related work, particularly for 'local' time stamps.
Does anyone know anything about computer forensics in this or neighbouring areas? What problems does the apparent lack of time zone support introduce, and how are they overcome -- use of Zulu time throughout?
- Senior Member
- forveuxSo would it solely affect work in the....+14 time zone?
I think so ...
My first question was based on the IANA Pacific/Kiritimati time zone specification. I've noted since that the CIA World Factbook does not mention +14 in conjunction with Kiribati/Line Islands. That could explain why it's not supported by Windows.
On the other hand, HM Nautical Almanac says +14 (based on their web site).
- Senior Member