Registry and MFT off by 1 hour?

kbleich · 2013-05-28T20:29:11Z

Hello all,I'm new on this forum and wished to pose a question. Here is an interesting question, one which likely has an easy answer that Im just missing.I have a USB device connection and subsequent copying of files. Setupapi.dev.log from the system shows the connection date and time on December 10, 2012 at 201PM.MFT shows the files begin being created on the USB device at 20125PM (I have an image of the USB device)However, the analysis of the registry (USBStor and MountedDevices) shows the USB connection at 301PM……My assumption at this point is that the system BIOS reflects a date and time that is one hour off, and the registry is deriving its date/time from there. I currently don't have access to the physical systems to confirm but hopefully will be getting that this week.Thoughts?

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by keydet89 12 years ago

11 Posts

4 Users

0 Reactions

738 Views

RSS

keydet89

(@keydet89)

Famed Member

Joined: 21 years ago

Posts: 3568

28/05/2013 10:56 pm

Maybe I am not seeing it, but did you boot the computer to see if the time was, in fact, correct?

The OP had stated "…I currently don't have access to the physical systems to confirm…", but that might not perclude making a VM out of the image…

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
256 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed