Time Zones and Microsoft Windows

Windows has dealt with differing time zones in more or less the same way since the Registry was introduced with Windows 95.

In NT based operating systems the different time zones available to it are in the registry key: HKLM\SOFTWARE\Microsoft\Windows NT\Time Zones\. The current time zone setting is in HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\. This latter key contains the following data/value pairs:

• ActiveTimeBias - this is the bias (recorded as a signed integer in minutes) that is currently being applied to the local time to convert it TO UTC. It is a result of adding Bias and either StandardBias or DaylightBias depending on whether DST is in effect or not.
• Bias - this is the bias (in minutes) that applies for this timezone irrespective of whether StandardTime or DaylightTime is in effect.
• DaylightBias - the amount of additional bias to apply when daylight savings time is in effect.
• DaylightName - the display name when DST is in effect.
• DaylightStart - this value is an encoded version of the date and time that DST will start.
• StandardBias - the amount of additional bias to apply during standard time (in most cases this is 0).
• StandardName - the name to display when DST is not in effect.
• StandardStart - the encoded date and time that standard time starts.

When examining dates and times on Windows systems the Forensic Examiner should be aware of the issue of ambiguous times.