Re: Dating the creation of a CD-R/RW?

From: Nexus (nexusat_private-way.co.uk)
Date: Tue Oct 08 2002 - 06:49:48 PDT

  • Next message: Pedro Miller Rabinovitch: "Re: Dating the creation of a CD-R/RW?" 

    ----- Original Message -----
From: <James.Holleyat_private>
To: <dreadnoughtat_private>
Cc: <forensicsat_private>
Sent: Tuesday, October 08, 2002 2:02 PM
Subject: Re: Dating the creation of a CD-R/RW?
[snip]

> I am not sure how to decode the 4036 into Time Zone and Type value. Unless
> Time Zone is 4 hours off of GMT and type is 036. Maybe someone else can
> answer that.
[snip]

(ph33r the power of google ;-)
From some specs I found at http://www.osta.org/specs/pdf/udf201.pdf

2.1.4.1 Uint16 TypeAndTimezone;
For the following descriptions Type refers to the most significant 4 bits of
this field, and
TimeZone refers to the least significant 12 bits of this field, which is
interpreted as a
signed 12-bit number in two's complement form.
$ The time within the structure shall be interpreted as Local Time since
Type shall
be equal to ONE for OSTA UDF compliant media.
? Type shall be set to ONE to indicate Local Time.
$ TimeZone shall be interpreted as specifying the time zone for the location
when
this field was last modified. If this field contains -2047 then the time
zone has
not been specified.
? For operating systems that support the concept of a time zone, the offset
of the
time zone (in 1 minute increments), from Coordinated Universal Time, shall
be
inserted in the TimeZone field. Otherwise the TimeZone shall be set
to -2047.
Note: Time zones West of Coordinated Universal Time have negative offsets.
For
example, Eastern Standard Time is -300 minutes; Eastern Daylight Time
is -240
minutes.
Note: Implementations on systems that support time zones should interpret
unspecified
time zones as Coordinated Universal Time. Although not a requirement, this
interpretation has the advantage that files generated on systems that do not
support time zones will always appear to have the same time stamps on
systems
that do support time zones, irrespective of the interpreting system's local
time
zone.

Cheers.




-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    This archive was generated by hypermail 2b30 : Tue Oct 08 2002 - 07:23:06 PDT