Which time zone is being shown in a message record?¶

A messaging record may show a date and time without stating the time zone.

Evidential caution: that every timestamp is already in local time.

What this means¶

Messaging applications, devices, exports, providers and forensic tools may use different time bases. A phone screen may show local device time. A provider may record UTC. An export may convert data using the settings of the device that created it.

The same message can therefore appear with different times in different sources while still referring to the same event.

Travel, roaming and manual clock changes can complicate matters further. A device may have changed time zones during the conversation. Some applications display older messages using the device’s current zone rather than the zone in use when the message was sent.

Daylight-saving changes can create apparent one-hour differences. Relative labels such as “today” or “yesterday” may also become misleading once screenshots are reviewed later.

For provider returns or technical exports, look for documentation explaining whether times are UTC, local, offset-based or stored as an epoch value. Seek specialist help if the time format is unclear.

When comparing records, convert them to a common reference only after preserving the originals. Document the conversion, including daylight-saving treatment.

What to check or do next¶

• Record the device time zone, automatic time settings, location and date of capture where available. Preserve the original record before converting anything.
• Do not change times in a report without explaining what has been done. A correct conversion should be reproducible by another reviewer.