Hi Team,
I have noticed whilst adding an image file, Autopsy give us the option of selecting the time-zone.
However, is there a way to edit the image time-zone later?
Since in most cases one may have to manual search through the registry time value to identify the time-zone.
Thanks!
As a general best practice during any examination, you should always do everything in UTC and then convert accordingly, if needed. Even when you find out what the proper time zone it, you should stay constant in UTC because many logs and other data sources are UTC by default.
Nothing is worse than rebuilding the timeline from multiple data sources, and you realize one image is set for UTC + 7, which another data source is set for UTC, and another is UTC-3.
That being said, I do not know if you can change the timezone after the fact, I do not believe that you can, I will have to poke through it later on and see, but if you do everything in UTC, changing the timezone will never be a factor
Did you find a way to edit the timezone?