Registry and MFT off by 1 hour?

kbleich · 2013-05-28T20:29:11Z

Hello all,I'm new on this forum and wished to pose a question. Here is an interesting question, one which likely has an easy answer that Im just missing.I have a USB device connection and subsequent copying of files. Setupapi.dev.log from the system shows the connection date and time on December 10, 2012 at 201PM.MFT shows the files begin being created on the USB device at 20125PM (I have an image of the USB device)However, the analysis of the registry (USBStor and MountedDevices) shows the USB connection at 301PM……My assumption at this point is that the system BIOS reflects a date and time that is one hour off, and the registry is deriving its date/time from there. I currently don't have access to the physical systems to confirm but hopefully will be getting that this week.Thoughts?