Time zones issue

Is my approach reasonable?

Cannot say if reasonable, what I personally would do is to work in a PC (or VM) with date/time set to the same timezone as the original data come from.

Can anyone correct it if necessary?

Yes roll .
http//homepage.ntlworld.com./jonathan.deboynepollard/FGA/questions-with-yes-or-no-answers.html

I've browsed the forum and found some relevant posts but the links to support materials were already dead.

Provide the links to the posts that have the dead links, and possibly/hopefully someone can provide updated ones (or provide the linked material from a backup).

Also consider that there are several versions of Excel and Word and the metadata in their files may be different in different versions, besides a few "queer" behaviours.
Just as an example
http//www.forensicfocus.com/Forums/viewtopic/t=10627/
AND check the corey_h 's metadata related docs
http//www.forensicfocus.com/Forums/viewtopic/p=6567238/#6567238
http//code.google.com/p/jiir-resources/downloads/list

jaclaz

Thank you!

I like the idea of adjusting time zone on a machine (virtual or physical) however it's not always doable. First - I need additional Office license for VM (thank you, MS for you licensing ideas!) and second, some apps get crazy when playing with system clock. (

Nevertheless I adjusted my system clock in this case and now both Office apps and Metaviewer report the same date & time so it looks promising.

As to the dead links - here's the post I found - if anyone can provide updated links to both papers (Guidance & Microsoft) it would be great.

Have you allowed for the fact that most of the northern hemisphere (except Iceland) will be on Summer time / daylight saving etc.

UTC is the same as GMT - ie 12 noon is when the sun is overhead Lewes (sorry I mean Greenwich) 365 days a year.

Thanks for pointing this - I do remember about potential daylight issues.

I like the idea of adjusting time zone on a machine (virtual or physical) however it's not always doable. First - I need additional Office license for VM (thank you, MS for you licensing ideas!) and second, some apps get crazy when playing with system clock. (

With all due respect ) , I can see no real reason to have a MS Office suite installed, there are several much more "portable" viewers (which are an additional safeguard about modifying files inadvertedly) , just as an example
http//www.officeviewers.com/

Nevertheless I adjusted my system clock in this case and now both Office apps and Metaviewer report the same date & time so it looks promising.

Good.

As to the dead links - here's the post I found - if anyone can provide updated links to both papers (Guidance & Microsoft) it would be great.

You mean the one on this post? (you pointed to the whole thread)
http//www.forensicfocus.com/Forums/viewtopic/p=3703/#3703

Whenever you find a dead link, trying it on the Wayback Machine (Archive.org) is good idea wink
http//web.archive.org/web/*/http//www.guidancesoftware.com/corporate/downloads/whitepapers/Timezonewpv3.pdf

http//web.archive.org/web/20060621152234/http//guidancesoftware.com/corporate/downloads/whitepapers/Timezonewpv3.pdf

jaclaz

Thank you again!

I didn't point to a particular post in the mentioned thread as there were two papers and in both cases links were dead.

I will gladly go through Guidance paper!

I didn't point to a particular post in the mentioned thread as there were two papers and in both cases links were dead.

Good, I was only highlighting (being a very picky kind of guy) how you provided a link to a whole thread saying you were linking to a single post .

The "other" link can be resolved (with a little more work) to
http//web.archive.org/web/20060206224858/http//msdn.microsoft.com/library/en-us/sysinfo/base/file_times.asp

jaclaz