Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

At the end of a browsing week, the content from the Daily INDEX.DAT files is archived into a single Weekly INDEX.DAT file.  The actual timestamp information within the binary file changes for this file type when compared to the other files.  When the Weekly INDEX.DAT file is created, the created timestamp is saved at offset 0x10 of every URL record.  This is different to the other INDEX.DAT records as this location usually represents the Last Visited UTC Timestamp.

...

This timestamp is in FILETIME format and is saved as a UTC value.  This timestamp is presented within NetAnalysis in the “Date Index Created [UTC]” column.  The last visited timestamp is saved at offset 0x08 as a LOCAL timestamp.

...

With this timestamp, NetAnalysis takes the unaltered LOCAL time and saves it to the “Last Visited [Local]” column.  Unfortunately, the Last Visited UTC FILETIME value which was present in the Daily INDEX.DAT is not saved within the record and therefore has to be converted from a Local timestamp.  To calculate the UTC timestamp for the “Last Visited [UTC]” column, NetAnalysis takes the LOCAL timestamp at record offset 0x08 and converts it to UTC.  This conversion is calculated using the Time Zone value set in NetAnalysis prior to importing any data.  In doing so, dynamic daylight settings are also taken into account for any year on year differences.

...

In this case, the “Last Visited [UTC]” column will remain empty.  The “Last Visited [Local]” timestamp for Weekly entries is not changed or affected by NetAnalysis Time Zone settings.  It is left in an unaltered state.

...

Microsoft Internet Explorer Weekly INDEX.DAT FILETIME Timestamp
0x08
Last Visited Timestamp in LOCAL time
0x10
File Created Timestamp for INDEX.DAT in UTC

 

 

NetAnalysis Representation for Weekly INDEX.DAT
Last Visited [UTC]
UTC Timestamp converted from LOCAL entry incorporating DST adjustment
Last Visited [Local]
Unaltered Last Visited Timestamp from offset 0x08
Date Index Created [UTC]
Unaltered File Created Timestamp for INDEX.DAT in UTC