search

Dijji / XstReader

Xst Reader is an open source viewer for Microsoft Outlook’s .ost and .pst files, written entirely in C#. To download an executable of the current version, go to the releases tab.
Microsoft Public License
479 stars 70 forks source link

Timestamp in UTC #52

Closed vikas891 closed 2 years ago

vikas891 commented 2 years ago

I asked around but to no avail. Is the date/time recorded in an OST/PST in UTC?

I ran a few tests and XstReader correctly displays the LOCAL TIME on the source machine when the email was sent/received. The time-zone of the host where you are executing XstReader does not matter, which is a good thing.

Any idea the times could be parsed in UTC as that's the forensic gold standard?

Thanks, Vikas

iluvadev commented 2 years ago

I don't know if all DateTime properties in an OST/PST file are in UTC, but the information about message delivery, submitted and last modification are in UTC, according to the MS specification [MS-OXPROPS]

The properties used in XstReader for DateTime information in messages are:

In the linked docs, MS says that all these DateTime info are in UTC.

Is this what you need?

vikas891 commented 2 years ago

That's it! @iluvadev 👍 I couldn't find your Twitter handle to thank you. https://twitter.com/vikas891/status/1478252358819725312