±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 33490
New Yesterday: 1 Visitors: 172

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

QuickView Plus 2017 time format issue UTC vs GMT

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: QuickView Plus 2017 time format issue UTC vs GMT

Post Posted: Tue Jan 23, 2018 4:59 am

Hi All,

I have had the following response from Avanstar in response to my query regarding the time displayed in the QuickView Plus 2017 program.

"Quick View Plus 2017 does display all times as is listed in the file as UTC. Without any modification or alteration for Daylight Savings time or other factors.
It does this uniformly across all files.
Microsoft Outlook adjusts all times in the file according to the system local time and settings.
[i]"

So it would seem that all dates and times are shown in UTC which will differ to what is being displayed in Microsoft Outlook because it takes in to account daylight savings time (in the UK +1 hour for summer time etc) and other factors.

So I assume then we would need to include a statement in our examination report that explains the use of UTC and how times are calculated.

Has anyone else incurred this kind of issue?

Kind regards

Richard  

rhall47
Member
 
 
  

Re: QuickView Plus 2017 time format issue UTC vs GMT

Post Posted: Tue Jan 23, 2018 10:51 am

Sure, it is perfectly "normal" and "common", as said the computer keeps time along a "standard", the UTC.

Then *any* "normal" program/tool (not forensic ones) will convert the UTC standard to the local timezone (at the moment), as set in the OS Control Panel (or similar).

The UK is normally in the timezone GMT, but when DST is in force it "moves" (virtually) to GMT+1, as per the already given link, or - if you prefer - the time zone changes to BST:
www.timeanddate.com/time/zones/bst

There are tens of converters (online/offline) to make this calculation (if needed).

BUT basically in your case for all dates within the DST in effect time frame (you will need to check for the year(s) in question) you need to add one hour.

Example:
UTC (or Zulu) Time 13:15.12 -> UK local time WITHOUT DST-> GMT time zone Time 13:15.12
UTC (or Zulu) Time 13:15.12 -> UK local time WITH DST-> GMT+1 time zone Time 14:15.12

You need to check by date if DST was in effect or not by date, using a table like:
www.timeanddate.com/ti.../uk/london


jaclaz

Edit: corrected a few typos here and there.
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 


Last edited by jaclaz on Tue Jan 23, 2018 1:41 pm; edited 1 time in total

jaclaz
Senior Member
 
 
  

Re: QuickView Plus 2017 time format issue UTC vs GMT

Post Posted: Tue Jan 23, 2018 1:32 pm

- rhall47

So it would seem that all dates and times are shown in UTC which will differ to what is being displayed in Microsoft Outlook because it takes in to account daylight savings time (in the UK +1 hour for summer time etc) and other factors.


If you look at the underlying MAPI properties, you will find that timestamps are stored in UTC in an Outlook/Exchange environment. For instance, the MSDN documentation for PidTagClientSubmitTime (i.e., sent date) indicates that it "[c]ontains the current time, in UTC, when the email message is submitted."

msdn.microsoft.com/en-...g.80).aspx

When an item is displayed in Outlook, the timestamp is normalized to the local time of the displaying computer using the Windows global time zone database. Here is some info and an example on how time zone normalization works in Outlook:

support.microsoft.com/...ft-outlook

When viewing messages in Outlook, if you change the time zone of the local computer, you should see that the time that Outlook displays in its user interface will change as well due to time zone normalization. So, if you switched your review computer's time zone to UTC without daylight savings time, you should see that the timestamps displayed by Outlook are in UTC. Based on the developer's statement, this should match what QuickView shows you.

- rhall47

So I assume then we would need to include a statement in our examination report that explains the use of UTC and how times are calculated.


If your report contains timestamps, I think you should include a statement that indicates the time zone of the timestamps anyway. Some applications store timestamps with a time zone offset (e.g., 2014-08-11T11:32:15-04:00). In those cases, it is often preferable to include the time zone offset of each time stamp as it can be used to establish the time zone settings of the local computer where the file was created/modified/accessed, etc.
_________________
Arman Gungor

Metaspike
Developers of Forensic Email Collector
www.metaspike.com 

gungora
Member
 
 
  

Re: QuickView Plus 2017 time format issue UTC vs GMT

Post Posted: Wed Jan 24, 2018 7:35 am

Jaclaz/Arman,

Thank you both for your detailed response, your description explain a great deal that I had not fully understood before so this has been a very worthwhile exercise.

Given what I now understand we shall craft an explanation which we will include in a future examination report that will explain the facts and hopefully help the reader understand the purpose and relevance of the date and time stamps.

Thank you very much for taking the time to respond, i'm very grateful to you both.

Regards

Richard  

rhall47
Member
 
 

Page 2 of 2
Go to page Previous  1, 2