Time Zone Concept
The following applies to WinHex and X-Ways Forensics when operated with a specialist or forensic license.
X-Ways Forensics employs its own, not Windows' logic to convert UTC timestamps to a freely chosen time zone for display in the directory browser, in report tables and exported lists. It displays timestamps independently of the time zone selected in the examiner's system's Control Panel. The display of timestamps in X-Ways Forensics may differ from Windows because in Windows a timestamp in daylight saving time is not displayed based on daylight saving time if daylight saving time is not active when looking at that timestamp.
When working with a case, the time zone selected for that case applies globally to the entire program (selectable in the Case Properties), otherwise the one selected in the General Options dialog. When working with a case, optionally it is possible to specify different time zones per evidence object, so that you can always see local filetimes even for media that were used in different time zones, if preferable. Note that the timestamps are converted for display only. That means, in a recursive view in the case root that covers multiple media, sorting is based on absolute UTC timestamps. Optionally, the actually used conversion bias can be displayed as well (see directory browser options).
Timestamps on FAT volumes are never converted as they are not available in UTC, but based on one or several unknown local time zones. Timestamps in file systems that store the time zone explicitly are converted to UTC internally and then for diplay purposes from UTC to a local time zone.
The time zone definitions can be adjusted, if necessary. Please note that changing these definitions in any dialog window affects the definition of time zones throughout the program.
The standard Windows conversion technique, which depends on the time zone selected in the user's system's Control Panel, is still employed...
- in File | Properties, where the timestamps of files on the user's own system can be accessed/changed,
- for the case logging feature,
- generally when operated without a specialist or forensic license, and
- when operated without the file "timezone.dat".
You can tell that either of the latter two is true if the "Display time zone" button in the General Options dialog is grayed out or not visible.