# Possible inconsistency in metadata date/time.

**URL:** <https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677>\
**Category:** Autopsy Help\
**Created:** [June 14, 2021, 6:12pm UTC](https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677 "2021-06-14T18:12:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![oscarjs](https://avatars.discourse-cdn.com/v4/letter/o/bbce88/32.png) [@oscarjs](https://sleuthkit.discourse.group/u/oscarjs)\
**Post date:** [June 14, 2021, 6:12pm UTC](https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677/1 "2021-06-14T18:12:18Z")

</div>

I am having inconsistency between the dates of the files in the filesystem, and in the metadata extraction.  
It has happened to me in several projects.  
Specifically I have an hour difference.

For example, .docx file with “Created Time” in the “Views” section is: 2021-01-13 10:55:39 CET  
Then, if I run the “Keyword Search” module, it appears in the section “Extracted content”, “Metadata”, “Date Created”: 2021-01-13 09:55:39 CET. One hour of difference.

I have tried changing the “time zone” in options, I have tried creating the project with different “time zones”, but there is always one hour difference.  
The same thing happens to me with “Exif extraction” for photos.

Am I doing something wrong or is it an Autopsy bug?

---

<div class="post-metadata">

**Author:** ![lfcnassif](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/lfcnassif/32/1101_2.png) [@lfcnassif](https://sleuthkit.discourse.group/u/lfcnassif)\
**Post date:** [June 18, 2021, 4:36am UTC](https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677/2 "2021-06-18T04:36:53Z")

</div>

This could be an issue with DST times. A colleague of mine reported a similar problem to me when using IPED tool (that uses sleuthkit tsk\_loaddb under the hood)

---

<div class="post-metadata">

**Author:** ![oscarjs](https://avatars.discourse-cdn.com/v4/letter/o/bbce88/32.png) [@oscarjs](https://sleuthkit.discourse.group/u/oscarjs)\
**Post date:** [June 18, 2021, 5:16am UTC](https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677/3 "2021-06-18T05:16:36Z")

</div>

Well it happened to me this week (CEST), but also happened last January (CET) with two different projects.

---

<div class="post-metadata">

**Author:** ![lfcnassif](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/lfcnassif/32/1101_2.png) [@lfcnassif](https://sleuthkit.discourse.group/u/lfcnassif)\
**Post date:** [July 19, 2022, 5:04pm UTC](https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677/4 "2022-07-19T17:04:18Z")

</div>

> [@oscarjs](#):
>
> The same thing happens to me with “Exif extraction” for photos.

Recently I fixed this bug in Tika library that affects some Exif extracted Dates:  
[https://issues.apache.org/jira/browse/TIKA-3815](https://issues.apache.org/jira/browse/TIKA-3815)

I think it is used by Autopsy too and may affect the Exif decoded Dates.

---

<div class="post-metadata">

**Author:** ![oscarjs](https://avatars.discourse-cdn.com/v4/letter/o/bbce88/32.png) [@oscarjs](https://sleuthkit.discourse.group/u/oscarjs)\
**Post date:** [July 21, 2022, 12:14pm UTC](https://sleuthkit.discourse.group/t/possible-inconsistency-in-metadata-date-time/2677/5 "2022-07-21T12:14:13Z")

</div>

Thank you Luís, I hope the next version of autopsy includes your fix.