Bugs item #2890983, was opened at 2009-11-02 17:59
Message generated for change (Tracker Item Submitted) made by robjoyce
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2890983&group_id=55685Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Time zone on HFS+ volume creation date
Initial Comment:
Apple TN 1150 says that the volume creation timestamp is in the local time zone, not UTC, for historical reasons. (This is not true of the volume modification time or other timestamps.) hfs.c's fsstat assumes that all the volume timestamps are in UTC. This leads to, at best, the volume creation timestamp being double-corrected for timezone. (e.g., if a volume created at 12:00 EST would have 12:00 set in its volume header, which SK would then read as 12:00 UTC and print out as 08:00 EST.)
In general, there's no way to know what the timezone might have been at format time. The attached patch prints the volume creation date in its native form... if the volume was formatted in the same timezone as the investigator's current TZ, the time will be correct. Otherwise, at least we're displaying what's on disk, and not wrongly correcting for some unknown TZ.
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2890983&group_id=55685------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference_______________________________________________
sleuthkit-developers mailing list
sleuthkit-developers@...
https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
