Re: [sleuthkit-users] Time Zone

[Brian C. <ca...@sl...>]

On 13 Aug 2003 18:50 PDT you wrote:

> Hi All,
> 
> I am troubled in a thyme zone.
> TSK and Autopsy display a different value in the same thyme zone.
> A fls command displays the correct time.
> Autopsy generates a gap for nine hours.
> Do I have a solution method?
> 
> 
> [The Sleuth Kit ver 1.64]
> $ ./fls -8 -l -f ntfs /home/hideaki/evidence/6gtest/RedHat9/images/thinkpad.dd
> 
> r/r 4-128-4:    $AttrDef        2003.08.02 08:33:30 (JST)       2003.08.02 08:33
> :30 (JST)       2003.08.02 08:33:30 (JST)       2560    0       48

Interesting.  I'm going to need some more information.  What 
happens if you run 'fls' with '-z JST'?  What if  you skip the -8? 
What did you enter into the Host configuration for the timezone?  
Enter that with the -z and fls and see what that shows.   Actually, 
which time is correct?  

thanks,
brian

> 
> [autopsy-1.73]
> r / r    $AttrDef    2003.08.01 23:33:30 (JST)    2003.08.01 23:33:30 (JST)    2003.08.01 23:33:30 (JST)    2560    48    0    4-128-4  
>