Hi all,
I have come across a case involving a Mac running OS X Sierra. It has been processed in FTK, Encase and Blacklight. All three pieces of software have been set to GMT time zone. Yet for a large amount of files I have been presented with the same created dates but a different "Accessed" time-stamp from Blacklight. I have mentioned this to Blacklight but they do not seem to have an answer. See below for what each application presents.
FTK
Created 09/02/2016 111602
Accessed 03/07/2017 130831
Encase
Created 09/02/2016 111602
Accessed 03/07/2017 130831
Blacklight
Created 09/02/2016 1116
Accessed 03/07/2017 1208
I have double and triple checked I have not made a simple mistake and I am looking at the exact same files in the same location.
Does anyone here have any ideas why this could be?
Thanks in advance.
My guess is it is a DST issue
As above.
Black light may be displaying in UTC as opposed to local time
Just in case
https://
You posted an example of July, check the other "1 hour shifted dates", if they are all in (I believe you are in UK) within the BST timeframe (26 march-29 October)
https://
https://
Or maybe it is due to your PC being currently in BST?
jaclaz
Hi all,
Thank you for your responses and yes correct we are in the UK.
I did double check to see if Blacklight adjusted for time zones. I changed from BST to New Zealand and as expected the timestamps of files changed. I assumed (possibly incorrectly) that blacklight would allow for GMT and BST and in particular the 1 hour difference like i believe Encase and FTK do.
I will check the other dates that are in GMT when i am back at work and see what they have to say.
Thank you.
Thank you for your responses.
Blacklight tech support have been rather helpful and got back to me before I got round to testing the theory out.
As mentioned by a number of users it would appear that currently Blacklight does not automatically adjust for daylight savings time which explains the discrepancy.
Blacklight have informed me that they have passed this onto the developers to look into adding this feature into the software although it may not be in 2017r1 as this is currently being tested.
Thanks