Childlike Empress
Banned
As a technically-minded person (or at least enough to know what to search for), this is kind of hilarious as "evidence".
The timestamps (created, modified, accessed) associated with a file on either a Windows or Unix-based operating systems (including Linux) are not timezone aware. They are stored as UTC.
It's done this way to make conversion to local time much easier. Otherwise, before displaying the timestamp to the user, the operating system would have to either 1) convert the timestamp from "the file's local time" to UTC, then back to your system's local time, or 2) calculate the relative offset between the file's local time and your system's local time and then apply that to the timestamp.
Both of those options are a complete waste of CPU cycles. In addition, storing the timezone info along with the timestamp takes up unnecessary space (disk and memory).
Early pioneers in this field were all about optimization, because they had very little processing power and storage to work with. They had to make the most of what little they had.
RAR Times: Local or UTC?
Forensicator said:Some reviewers have questioned the claim stated in the Guccifer 2.0 NGP/VAN Metadata Analysis report that the .rar files analyzed in that study recorded file times in local (relative) time. In short, newer implementations of WinRAR use the “version 5” format and in that format times are recorded as UTC times. However, the .rar files analyzed in this study use the older version 4 format which records times in “local” (relative) format. [...]