[sleuthkit-developers] [ sleuthkit-Bugs-2922773 ] timestamps are differently "formatted"

[SourceForge.net <no...@so...>]

Bugs item #2922773, was opened at 2009-12-29 07:04
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2922773&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Closed
Resolution: None
Priority: 5
Private: No
Submitted By: oncer oncer surname (oncer82)
Assigned to: Nobody/Anonymous (nobody)
Summary: timestamps are differently "formatted"

Initial Comment:
Here are timestamps present for each "file" obtained withTSK.
The issues is that, those timestamps are differently "formatted" for different File Systems.

For example: 
    - for FAT timestamps are represented as adjusted to localtime.
    - for NTFS timestamps are represented as they are (seems like this is better for a Client)

Is this a good behavior of TSK for a Client ? - seems like timestamps should not be formatted before returning them to a Client (like it is done for FAT) - they should be returned to a Client as they are.  Is not this correct?

This issue is for FAT due to using mktime (at dos2unixtime function) - this function performs an adjustment accordingly to a localtime.


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-12-30 17:33

Message:
The difference is because FAT stores the times in the timezone of the
computer and not in GMT. TSK adjusts the FAT times to GMT time based on the
timezone of the analysis computer so that it is consistent in TSK_FS_META
with other file systems. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2922773&group_id=55685