Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Do files written and timestamped in a certain timezone simply keep the -0000 time in their modification and creation timestamps and adjust the time displayed according to the user's timezone? Or do files keep the timezone information?

So if someone in timezone A sends a file to someone else in timezone B, can the latter know A's timezone just by inspecting the file? (I'm supposing not, but not sure)

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

It depends. If you're transmitting the data over the internet, such metadata is usually not preserved. If you hand over a USB stick, the "Last Modified" and "Date Created" fields might give some indication of timezone if you know what local time the files were modified / created - just a simple subtraction will work. The same goes for RAR archives, which preserve that metadata in the file table.

I'm not aware of any archive formats or filesystems that store the timezone as part of the timestamp metadata.

share|improve this answer
add comment

Filesystems typically do not store time zone information. Good filesystems (e.g. Linux's ext2/3/4, BSD's ffs, Windows' NTFS) are defined to store all dates in UTC, i.e. as abstract instant in the conventional reference time scale; conversion to local time is done when reading the metadata from the filesystem and displaying it to the user. Bad filesystems (e.g. FAT) store dates in "local time", whatever the local time is at the time of writing, and do not contain any field indicating what the current time zone is. So FAT does not indicate the time zone of the machine which wrote the file, but you actually need to know that time zone from some other source if you want to make sense of the timestamps in the filesystem.

Some archive formats (e.g. tar, very common in the Unix world) will record some timestamps, but they copy it from the filesystem, so they are as timezone-less as the timestamps in the filesystem.

This is a rather generic way of computing things. A time zone is a way to interpret an "instant" (in the common time scale) into a "local time". In countries which practice daylight saving time, computers switch time zones twice per year, making usage of local time a bit delicate (people get away with it because the switch happens when they sleep, and they are officially requested to behave as if the switch never happened; but for computers, this is bad: they don't like it that "October 27th, 2013, 02:30" ambiguously designates two instants in Europe). Thus, when computers are aware of time zones, they internally compute with UTC and convert to "local time" only when it comes to talking to humans. Therefore, filesystems and other data storage systems tend to store dates as UTC. The "current time zone" is a fleeting information which is subject to change, hence not written. Local time is stored only by systems which are not aware of time zones (they know only of one time scale, which they assume to be meaningful to the human user), and these systems, of course, cannot write down their current time zone, since they don't know it.

Note that some information can be written in other places. For instance, digital cameras will produce image files with a lot of metadata information (using the EXIF format) and will do their best to indicate the exact geographical position of the camera at the time the picture was shot. In particular, if the camera contains a GPS receiver (as is typical of modern smartphones), it will pinpoint the camera within a few meters, which is a lot more accurate than simply knowing the time zone (a time zone is as precise as "somewhere in Europe").

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.