[sleuthkit-developers] [ sleuthkit-Bugs-2890983 ] Time zone on HFS+ volume creation date

[SourceForge.net <no...@so...>]

Bugs item #2890983, was opened at 2009-11-02 17:59
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2890983&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Time zone on HFS+ volume creation date

Initial Comment:
Apple TN 1150 says that the volume creation timestamp is in the local time zone, not UTC, for historical reasons.  (This is not true of the volume modification time or other timestamps.)  hfs.c's fsstat assumes that all the volume timestamps are in UTC.  This leads to, at best, the volume creation timestamp being double-corrected for timezone.  (e.g., if a volume created at 12:00 EST would have 12:00 set in its volume header, which SK would then read as 12:00 UTC and print out as 08:00 EST.)

In general, there's no way to know what the timezone might have been at format time.  The attached patch prints the volume creation date in its native form... if the volume was formatted in the same timezone as the investigator's current TZ, the time will be correct.  Otherwise, at least we're displaying what's on disk, and not wrongly correcting for some unknown TZ.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-11-06 16:06

Message:
Thanks.  Applied to trunk.
Sending        trunk/CHANGES.txt
Sending        trunk/tsk3/fs/hfs.c
Transmitting file data ..
Committed revision 121.


----------------------------------------------------------------------

Comment By: Rob (robjoyce)
Date: 2009-11-02 18:04

Message:
(Patch is against the Nov 2 snapshot.)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2890983&group_id=55685