How should investigators convert times safely?¶

Investigators should convert times only after establishing what the original timestamp represents, which time zone applies and whether daylight-saving rules were in force.

The safest approach is to preserve the original value and document every conversion.

Avoid this assumption: That adding or subtracting a fixed number of hours will always produce the correct local time. It may not.

Time conversion depends on the named time zone, relevant date and any daylight-saving change. The United Kingdom, for example, is aligned with UTC during Greenwich Mean Time but is one hour ahead during British Summer Time.

Other jurisdictions may use different offsets, change clocks on different dates or not observe daylight saving at all. Historical time-zone rules can also differ from current rules.

Start by recording the original timestamp exactly as supplied, including any suffix such as Z, UTC, +00:00 or +01:00. Identify whether it is source time, server time, ingestion time or display time.

Use a recognised time-zone conversion tool or library that applies date-specific rules. Avoid relying on mental arithmetic where the event is material. Record the original value, original zone, converted value, target zone and conversion method.

Where the source time zone is unknown, do not guess and present the result as fact. Record the possible interpretations and seek confirmation from system configuration, provider documentation or a specialist.

If several records are being compared, consider converting them to one common reference, usually UTC, while retaining the originals. Check that spreadsheets or reporting tools have not silently reformatted the values.

Operational takeaway¶

Safe time conversion requires preservation of the original timestamp, confirmation of its source and zone, use of date-specific rules and a clear record of every conversion performed.