Hi all,
And first, excume for my grammatical.
In a project we are having a problem when we try to recover deleted emails from a pst file.
The problem is that the time from the recovered email is different if we compare the dates with the original email, we have seen that the different is for one hour, so, if the original was sended at 10.00 am we see that the recovered email show us that the email was sended at 9.00 am. The problem is happening with all the email recovered.
The problem is that the dates don´t coincide and we would need that the dates are the same to can submit it as a judge evidence.
Would you know which can be the origin of the problem?.
Thanks a lot and Regards.
Jesus
I would look at the obvious first - Time Zone settings on the server.
It could also be Daylight Savings time (DST) causing the hour difference. Which forensic analysis software are you using?
If you are using FTK 1.8 I know you have to set the option of timezone, dst etc after you added image file. If you are using FTK 3.2 you do it at the start and asks for the timezone so you should be ok.
But I would guess a 1 hour time difference due to DST. Remember windows can retroactively shift the timestamps depending on the computers DST.
This should help explain it better http//
Also, if the email were fetched from Outlook, check this link to see if this may apply to your case
http//
Cheers,
Craig
