Re: Was the HD formatted? (under Win95)

From: Michael H. Warfield (mhwat_private)
Date: Thu Oct 10 2002 - 08:09:35 PDT

  • Next message: Brian Carrier: "TASK 1.52 & Autopsy 1.62"

    	Picking numerous nits here...
    
    On Wed, Oct 09, 2002 at 11:04:51AM +0100, Andrew Hilborne wrote:
    > Brian Carrier <bcarrierat_private> writes:
    
    > > FAT does not care about timezones.  FAT stores the date and time as a 
    > > static value (not a delta as NTFS and UNIX do).  So, you should not
    > > see a change in times when you change the timezone.  
    
    	"NTFS and UNIX" is mixing apples and oranges.  "NTFS" is a file
    system (which some flavors of Unix even support to some extent) while
    "UNIX" is an operating system (family of operating systems) which may
    support a wide variety of file systems including ISO-9660, UFS, EFS,
    S51K, HTFS, XENIX (it's a file system and an ancient OS), EAFS, ext2,
    ext3, XFS, FAT, VFAT, NTFS, etc, etc, etc...  (gasps for breath)  Linux
    supports most of those file systems and has a couple that are not supported
    by other flavors of Unix.  When Unix is using the FAT/VFAT (MS-DOS/Windows
    FAT) file systems, it has to play by those rules on timestamps.  There are
    drivers for the Linux ext2/ext3 file sytems under Windows.  Windows has
    to obey the Unix convention for time when using those file systems.
    
    > I just wanted to correct this with respect to unix (I know very little about
    > NTFS.) Unix filesystem inodes store all timestamps in GMT (a.k.a. Zulu time.) 
    > It is user-space library functions which adjust these values for presentation
    > against the timezone which is currently set for the system.
    
    	Actually, not quite.
    
    	The time stored in the inodes of UNIX based file systems is a time_t
    value which is the number of seconds offset from the fixed time baseline
    (01/01/1970 00:00:00 UCT).  So it is a delta from that original baseline.
    If the timeval is a signed long (32 bits) this rolls over sometime in 2038
    and becomes negative.  In the ext2/ext3 (Linux) file systems it's stored as
    a __u32 (unsigned 32 bit) which doesn't roll over until sometime in 2106 or
    there abouts.  Since it is offset from a UCT/GMT/Zulu value, I guess you
    could say it's a GMT time.  Sort of.  At least is defined as being relative
    to an absolute GMT time.  But you are correct.  All the conversions from
    that internal value for presentation formats and timezones are done in
    user space libraries.
    
    	But the original poster could also be "interpreted" to be wrong
    when he wrote "FAT stores the date and time as a static value (not a
    delta as NTFS and UNIX do)" implying that the time values in UNIX (meaning
    UNIX based file systems) are not "static" values.  They are static values
    that are deltas from an absolute time baseline.  It also does not care
    (or change) with timezones.  It can be correctly and accurately represented
    in different timezones and correctly reflect the time being expressed.
    The time itself doesn't change, only it's representation and
    10:00 EST == 15:00 GMT.
    
    	I think there may have been some confusion in Brian's usage of
    the terms "static" and "delta" as if they were the converse of each
    other, which they are not.  "Static" and "delta" were also mixing
    apples and oranges resulting in a fruit salad of terminology.  ;-)
    
    > --
    > Andrew Hilborne
    
    	Mike
    -- 
     Michael H. Warfield    |  (770) 985-6132   |  mhwat_private
      /\/\|=mhw=|\/\/       |  (678) 463-0932   |  http://www.wittsend.com/mhw/
      NIC whois:  MHW9      |  An optimist believes we live in the best of all
     PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Oct 10 2002 - 08:18:17 PDT