...
At the end of a browsing week, the content from the Daily INDEX.DAT files is archived into a single Weekly INDEX.DAT file. The actual timestamp information within the binary file changes for this file type when compared to the other files. When the Weekly INDEX.DAT file is created, the created timestamp is saved at offset 0x10 of every URL record. This is different to the other INDEX.DAT records as this location usually represents the Last Visited UTC Timestamp.
...
This timestamp is in FILETIME format and is saved as a UTC value. This timestamp is presented within NetAnalysis in the “Date Index Created [UTC]” column. The last visited timestamp is saved at offset 0x08 as a LOCAL timestamp.
...
With this timestamp, NetAnalysis takes the unaltered LOCAL time and saves it to the “Last Visited [Local]” column. Unfortunately, the Last Visited UTC FILETIME value which was present in the Daily INDEX.DAT is not saved within the record and therefore has to be converted from a Local timestamp. To calculate the UTC timestamp for the “Last Visited [UTC]” column, NetAnalysis takes the LOCAL timestamp at record offset 0x08 and converts it to UTC. This conversion is calculated using the Time Zone value set in NetAnalysis prior to importing any data. In doing so, dynamic daylight settings are also taken into account for any year on year differences.
...
In this case, the “Last Visited [UTC]” column will remain empty. The “Last Visited [Local]” timestamp for Weekly entries is not changed or affected by NetAnalysis Time Zone settings. It is left in an unaltered state.
...
Microsoft Internet Explorer Weekly INDEX.DAT FILETIME Timestamp | |
0x08 | Last Visited Timestamp in LOCAL time |
0x10 | File Created Timestamp for INDEX.DAT in UTC |
NetAnalysis Representation for Weekly INDEX.DAT | |
Last Visited [UTC] | UTC Timestamp converted from LOCAL entry incorporating DST adjustment |
Last Visited [Local] | Unaltered Last Visited Timestamp from offset 0x08 |
Date Index Created [UTC] | Unaltered File Created Timestamp for INDEX.DAT in UTC |