Timeline Explorer Nirsoft BrowsingHistoryView Timestamp

[jcv-]

If you run Nirsoft BrowsingHistoryView with the following argument "/ShowTimeInGMT 1" and then load that file into Timeline Explorer, Timeline Explorer is then converting the value to what it believes is the UTC timestamp.

For example, if the timestamp in the tool's output is 2:44PM UTC (14:44 UTC) then Timeline explorer will convert this (based off local time?) to 19:44 UTC. Is there an option available or a way to prevent Timeline Explorer from converting that timestamp?

[EricZimmerman]

What's the default timestamp coming out? Local?

Is that a supported file type? Which means it's actually interpreting the dates as opposed to just showing strings? It sounds like it if you're seeing the date being shifted

You should only use UTC

If nearsoft is not including any kind of an actual time zone offset, then there really isn't much else that can be done since we generally assume UTC

[jcv-]

The default timestamp that is coming out is UTC if you provide the "/showtimeingmt 1" argument to the tool. If you do not provide that argument, then it comes out as the local time of the computer that you executed it on.

Looking at the tlefile plugin code, it looks like the time is being converted to UTC:

https://github.com/EricZimmerman/TLEFilePlugins/blob/6b47543d4ccd2f7f7d4e5030d65289f52fccf4de/TLEFileMisc/Misc.cs#L2915

            foo.Map(m => m.VisitTime).Convert(row =>
                DateTime.Parse(row.Row.GetField<string>("Visit Time")).ToUniversalTime());

Which is causing our time shift.

[jcv-]

Here is an example of the browsinghistoryview output without the argument to show time in gmt:

This is then converted to the correct UTC time when I open the file in timeline explorer:

If we use the /showtimeingmt 1 argument:

This is then converted to UTC in Timeline explorer and causes our time drift:

I believe the Kape configuration files for the browsinghistoryview module use the /showtimeingmt 1 argument when collecting data. If we are to assume that the log files are in UTC, should the conversion in the plugin be removed?

[EricZimmerman]

Yea I think that makes sense. We can add a note to the plugin that says it's assumed to be UTC time