🚀 go-pugleaf

On Tue, 06 Apr 2004 16:46:58 -0700, Bob Gonder wrote:

Lol. I was investigating this and came across some interesting code which
led on to an interesting options dialog box in our main investigation tool.
Amongst other things it contains the text:

"Some file systems store date/times in UTC (Coordinated Universal Time)
this is time zone independant and is equivalent to an all year round GMT.
Other file systems store the date/time without any conversion.

File systems that don't use UTC cause few problems for the investigator
since the date/time reported by GenX or GenTree is valid without any need
for conversion.

File systems that use UTC on the other hand require that date/times be
converted back into the original time zone before being displayed.
Unfortunately there is often no way to determine the correct time zone 
programmatically.

We have provided this option so that the user can decide what adjustment is
required and have GenTree apply it for them.

You should be aware that one feature of UTC based file systems is that
daylight savings causes the displayed date/time to change. A file created
during winter at 9am will be displayed during summer (by 
both GenTree and Explorer) as having been created at 10am."

The options on the dialog allow the user to disable conversion to local
time and to supply their own offset. I guess we've looked at this before
which is perhaps not surprising.

The comment from our investigation team was that they weren't really
bothered. Dates and times are so crucial to an investigation that any
discrepancies are soon weeded out and resolved. Having the above options is
handy but they don't really care since they expect to spend a lot of time
verifying and explaining date/times anyway.
-- 
Andrue Cope
[Bicester UK]