Possible inconsistency in metadata date/time.

Autopsy Help
1

I am having inconsistency between the dates of the files in the filesystem, and in the metadata extraction.
It has happened to me in several projects.
Specifically I have an hour difference.

For example, .docx file with “Created Time” in the “Views” section is: 2021-01-13 10:55:39 CET
Then, if I run the “Keyword Search” module, it appears in the section “Extracted content”, “Metadata”, “Date Created”: 2021-01-13 09:55:39 CET. One hour of difference.

I have tried changing the “time zone” in options, I have tried creating the project with different “time zones”, but there is always one hour difference.
The same thing happens to me with “Exif extraction” for photos.

Am I doing something wrong or is it an Autopsy bug?

2

This could be an issue with DST times. A colleague of mine reported a similar problem to me when using IPED tool (that uses sleuthkit tsk_loaddb under the hood)

3

Well it happened to me this week (CEST), but also happened last January (CET) with two different projects.

4

Recently I fixed this bug in Tika library that affects some Exif extracted Dates:
https://issues.apache.org/jira/browse/TIKA-3815

I think it is used by Autopsy too and may affect the Exif decoded Dates.

5

Thank you Luís, I hope the next version of autopsy includes your fix.