UTC vs local time in Windows artifacts

Most Windows artifacts store time in UTC, typically as a FILETIME: NTFS timestamps in the $MFT, registry last write times and event log records are all UTC. A minority record local time, which shifts with the configured time zone and daylight saving. Mixing the two without correction is one of the easiest ways to break a timeline by several hours.

Known local-time sources include FAT file system timestamps (Microsoft documents that FAT stores times in local time while NTFS uses UTC) and the device installation log setupapi.dev.log, often used for USB first-connection times. Text logs written by individual applications should be checked case by case.

To convert local times reliably, read the system's time zone configuration from the SYSTEM hive (see Registry hives):

SYSTEM\<ControlSet>\Control\TimeZoneInformation

Useful values include TimeZoneKeyName (the zone name), Bias (offset in minutes, where UTC = local time + bias) and ActiveTimeBias (the offset currently in effect, including daylight saving). The key's last write time can hint at when the time zone was last changed, but the key only reflects the current setting: if the zone changed during the period of interest, older local timestamps may need a different offset. Normalizing everything to UTC before building a super timeline avoids most errors.