Re: Ascertaining UDF and ISO CD time zone?

From: Claus Lund <clund(at)tax.state.vt.us>
Date: Thu Dec 12 2002 - 12:43:32 EST

It looks to me like your timestamp doesn't go by the standards...

Cut from the "Standard ECMA-167":
"Type and Time Zone (RBP 0)
The most significant 4 bits of this field, interpreted as a 4-bit number, shall specify the interpretation of the timestamp as shown in figure 1/8. The least significant 12 bits, interpreted as a signed 12-bit number in two' s complement form, shall be interpreted as follows: - If the value is in the range -1 440 to 1 440 inclusive, then the value specifies the offset, in minutes, of the date and time of the day from Coordinated Universal Time.
- If the value is -2 047, then no such value is specified. Type
Interpretation
0 The timestamp specifies Coordinated Universal Time. 1 The timestamp specifies local time.
2 The interpretation of the timestamp is subject to agreement between the originator and recipient of the medium.
3-15 Reserved for future standardisation. "

It looks like your 'Type' falls in the yet-to-be-determined category... Maybe the following documents will be able to help your friend: Standard ECMA-167 - http://www.ecma.ch/ecma1/STAND/ECMA-167.HTM UDF specs - http://www.osta.org/specs/index.htm

-Claus

• Original Message ----- From: "Mark G. Spencer" <dreadnought@arsenal.net> To: <forensics@securityfocus.com> Sent: Tuesday, December 10, 2002 9:37 AM Subject: Ascertaining UDF and ISO CD time zone?

> My coworker who is putting together the tutorial on UDF and ISO CD-ROM

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Dec 12 13:03:02 2002