[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sleuthkit-users
Subject:    Re: [sleuthkit-users] fls timezones
From:       Brian Carrier <carrier () sleuthkit ! org>
Date:       2012-08-09 13:22:27
Message-ID: ED558A2C-E4A1-45FA-A3F0-6101B427E997 () sleuthkit ! org
[Download RAW message or body]

RB is mostly correct.  For all file systems besides FAT, the timezone is only used when displaying a time in a human readable format.  It needs to convert the epoch time to the timezone that you want it printed in.  The one exception is FAT.  FAT does not store times associated with a timezone.  So, TSK needs to know the timezone that the file system times are stored in so that it can convert them to epoch. So, you should see a difference in the below test if the file system were FAT.

brian

On Aug 8, 2012, at 4:43 PM, RB wrote:

> On Wed, Aug 8, 2012 at 1:39 PM, x z <srvr.side@gmail.com> wrote:
>> but in "mactime" format the timezone is ignored (as below). Is this
>> behaviour because it is expected another tool (like mactime) will apply the
>> timezone adjustments, or am i doing something wrong?
>> (It would be nice if the adjustments could be applied by fls)
>> 
>> % fls -l -m C:/ -z "America/New_York" -o63 ../hdd_0.dmg | head -1
>> 0|C:/AUTOEXEC.BAT|7352-128-1|r/rrwxrwxrwx|0|0|0|1286480935|1286480935|1286480935|1286480935
>> 
>> % fls -l -m C:/ -z "America/Los_Angeles" -o63 ../hdd_0.dmg | head -1
>> 0|C:/AUTOEXEC.BAT|7352-128-1|r/rrwxrwxrwx|0|0|0|1286480935|1286480935|1286480935|1286480935
> 
> Epoch seconds are always in UTC, and hence it does not matter what
> timezone you request - they will always be UTC.
> 
> [aoz@test ~] TZ="America/New_York" perl -e 'print scalar
> localtime(1286480935) . "\n"'
> Thu Oct  7 15:48:55 2010
> [aoz@test ~] TZ="America/Los_Angeles" perl -e 'print scalar
> localtime(1286480935) . "\n"'
> Thu Oct  7 12:48:55 2010
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
[prev in list] [next in list] [prev in thread] [next in thread]