The ActiveTimeBias information is stored in the Time Zone Information sub-key as a REG_DWORD signed integer value. This value may be positive or negative. To establish the true value of the key, we must examine the information stored (see Figure 1).

Figure 1

As the REG_DWORD value can store both signed and unsigned values, with no way to differentiate between each type, it is displayed in the registry viewer as an unsigned value. To establish the two’s complement value, we must carry out the following calculation:

0xFFFFFF4C (Signed Integer Value)

Convert this to binary:

11111111 11111111 11111111 01001100

The MSB is set so we know that the above value will be negative. The next stage is to flip all the bits. This involves changing 1 to 0 and vice versa. This can be achieved quickly using the logical NOT function on a scientific calculator. You must ensure that it is set to deal with the correct number of bits.

00000000 00000000 00000000 10110011

Add 1 bit to the value above:

10110100

And then convert that value back to decimal, remembering that we are dealing with a negative number:

-180 (Minus 180)

Note

If the MSB had been zero, then the value would have been positive. With a positive value, just convert it directly to decimal. When using a scientific calculator using the logical NOT operator, ensure you are dealing with DWORD (32 bits).

## Bias Calculations

Examination of the Bias values in our example indicates that DST is active and the local time for that zone is 3 hours ahead of UTC (see Table 1).

Bias | HEX Value | DEC Value | Information |

ActiveTimeBias | 0xFFFFFF4C | -180 | Current local time is 3 hours ahead of UTC (shows DST active) |

Bias | 0xFFFFFF88 | -120 | 2 hours ahead of UTC during Standard Time |

DaylightBias | 0xFFFFFFC4 | -60 | 1 hour ahead of Standard Time when DST active |

StandardBias | 0x00000000 | 0 | No change for Standard Time |

Table 1