Contributors - CyberSecurity Malaysia

12.Figure 9: Interpreting “Active Time Bias”valueFigure 5: View Pane menu listing11. Please refer to Table 1 for further conversion of othertime zone properties.Figure 6: interpreting “Current” value7. Now we know that the control set is 1, we will nownavigate to the following: NTRegistry/$$$PROTO.HIV/ControlSet001/Control/TimeZoneInformation.Time ZonePropertiesActive time BiasBiasDaylight BiasDaylight NameDescriptionThis is the number of minutes offsetfrom GMT for the current timesetting. This is stored as a 32-bitinteger.This is the number of minutes offsetfrom the GMT for the time zonesetting. This is stored as a 32-bitinteger.The number of minutes offset fromthe Bias for DST setting. This isstored as a 32-bit integer.The name in the Unicode of the timezone DST setting.Figure 7: Users’s time zone setting8. This is the folder where the system keeps all the user’stime zone settings.9. Select Active time Bias, highlight the data and rightclick. Select “Bookmark Data” (Figure 8).Daylight Start,Standard StartStandard BiasPlease refer to figure 10. Highlighteither start time in the table Pane.Change the View Pane to Hex view.The number of minutes offset fromthe Bias for the Standard Time. It isusually zero.Standard Name The name of the Unicode ofthe standard time zone setting(Figure 11).Table 1: Time zone properties value formatFigure 8: Interpreting “Active Time Bias”value10. Decode the highlighted data by selecting “32-bitInteger”. This is because the Active Time Bias is beingstored in this type of value. Now, the data have beenconverted to -480 minutes (8 hours offset from GMT)(Figure 9).