As NetAnalysis imports data from Microsoft Internet Explorer Daily INDEX.DAT records, it checks the bias difference between the last visited UTC and local times and adds the calculated bias to the ActiveBias column. This information is checked against the bias information for the time zone set (in NetAnalysis Options) by the examiner. If the time zone has not been set correctly, or there are multiple time zone bias values encountered, NetAnalysis will flag this when it completes importing the INDEX data.
To establish where the problem lies, examine the ActiveBias column as shown in Figure 2. The ActiveBias column shows the bias for the highlighted record is -180 minutes [UTC +0300]. We can also see that for this import, the time zone was set to GMT Standard Time [UTC +0000]. The asterisk [*] symbol after the ActiveBias value indicates there is a problem and to review the Status column. The Status column shows there is an issue with the time zone settings.
At this point, it is advisable to review the content of the audit Log. This can be accessed from the Audit Log button on the main toolbar, or from the menu: Audit » View Audit Log. Figure 78 shows a portion of the audit log with a time zone warning highlighted.
It is clear from the information presented by NetAnalysis that the importation time zone setting is incorrect. Examination of the ActiveBias column also shows that there appears to be only one bias value identified. This indicates a single time zone setting but an incorrect import setting for NetAnalysis. In this case, you would simply check the time zone settings, select the correct value and then re-import the data.
If you have evidence of multiple time zones being set, you will end up with miscalculated timestamps if you select any of the standard time zone settings.
The recommended course of action in this case is to set the NetAnalysis time zone option to ‘No Time Zone Date / Time Adjustment’. With this setting, NetAnalysis will calculate the date/times exactly as they are stored in the file. You can then re-import the data into NetAnalysis. NetAnalysis will only represent what it knows to be accurate (assuming the clock was accurate on the system and the computer was being used in the time zone it was set to use).
To access the time zone settings, select Tools » Options from the Tools menu. Select ‘* No Time Zone Date/Time Adjustment’ from the Suspect System Base Time Zone dropdown list (as shown in Figure 4).