The times are one hour behind in FTK (FAT32).

The screenshot above illustrates the possible discrepancies that may occur in FTK given the scenarios from the table above. The files from the FAT32 partition in the screenshot have a true creation time of 6:44 PM to 6:45 PM.
The files named Before mar 07, After Mar 07, before oct 07, and After nov 07 were created outside of the affected date range and will always show correct timestamps in FTK. The files named between mar 07 and between oct 07 were created between the former and current effective dates for DST and FTK will give the display discrepancies as noted in the table on the previous page.
|