ksanchezcld / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
1 stars 0 forks source link

imageinfo does not handle timezones correctly #218

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
The imageinfo plugin attempts to apply the timezone information to the system 
time to produce the local time from the image. But because the system time is 
not explicitly set to UTC, the time zone shift fails. For example, the 
xp-laptop-2005-07-04-1430 image was acquired at 1430 local time. But here's 
what imageinfo says about its System time and Local time:

           Image date and time : 2005-07-04 18:30:32 
     Image local date and time : 2005-07-04 18:30:32 

It should display the local time like this:

           Image date and time : 2005-07-04 18:30:32 
     Image local date and time : 2005-07-04 14:30:32 -0400

The attached patch, which forces the System time as UTC, fixes the issue.

Original issue reported on code.google.com by jessekornblum on 21 Feb 2012 at 11:21

Attachments:

GoogleCodeExporter commented 9 years ago
Hiya, thanks for the spot.  It's been a whilst since I've investigated the 
timezone stuff.  As it turns out, we've got a flag used during object creation 
called is_utc, but that no longer appears to be set.  I'll probably add some 
machinery so that it can be specified after the object's been created, and then 
turn that on for SystemTime.  It then does the .replace(tzinfo=UTC) for 
WinTimeStamp objects...

Original comment by mike.auty@gmail.com on 22 Feb 2012 at 8:43

GoogleCodeExporter commented 9 years ago
This issue was closed by revision r1530.

Original comment by mike.auty@gmail.com on 10 Mar 2012 at 10:44