...
Microsoft Internet Explorer Daily INDEX.DAT FILETIME Timestamp | |
0x08 | Last Visited Timestamp in LOCAL time |
0x10 | Last Visited Timestamp in UTC |
NetAnalysis Representation for Daily INDEX.DAT | |
Last Visited [UTC] | Unaltered UTC Timestamp from record offset 0x10 |
Last Visited [Local] | Unaltered Local Timestamp from record offset 0x08 |
Establishing the Time Zone ActiveBias
As the URL record contains a UTC and Local timestamp, it is possible to establish the Time Zone ActiveBias by calculating the time difference between both timestamps. The follwoign following article discusses how to manually establish the Time Zone settings on the suspect computer:
...