Re: [sleuthkit-users] Tsk_loaddb timezone?

[Ketil F. <ke...@fr...>]

I think it uses local timezone. I reported this issue in Autopsy where
FAT timestamps are interpreted as a local timezone, and I'll assume
that tsk_loaddb would have done the same:

https://github.com/sleuthkit/autopsy/issues/1687

It should be fairly straightforward to test, though. Create a small
sample image with dd and mkfs -t fat, mount it loopback, create some
files, and finally run tsk_loaddb on the resulting image file to
compare tsk's file dates with the ones you set.

On 24 August 2016 at 21:38, Luís Filipe Nassif <lfc...@gm...> wrote:
> Hi,
>
> Anyone knows the answer? Does tsk_loaddb use UTC ou local timezone to
> interpret FAT FS dates?
>
> Thanks,
> Luis
>
>
> 2016-06-17 13:11 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>>
>> Hi,
>>
>> What timezone does tskloaddb use for fat file systems? It is possible to
>> configure it like Java bindings addimageprocess?
>>
>> Thank you,
>> Luis
>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>



-- 
-Ketil