Time Zone
The time zone set on the machine, needed for any artefact stored in local time.
Use it to convert artefacts stored in local time to UTC, using the zone and offset the machine was set to.
- SYSTEM
- System Information
What It Is
This key holds the time zone the machine is set to, with the offset from UTC and the daylight saving rules. It matters because several artefacts store their times in local time, so you need this zone to convert them to UTC and put them on one timeline. The key's own last write time shows when the zone last changed. It lives in the SYSTEM hive.
What It Proves
The zone in force when the hive was last written, and its offset from UTC. The key last write time shows when it last changed.
What It Does Not Prove
Only the current zone is kept, so earlier changes have to come from the System event log. Most artefacts are in UTC already, so this matters only for the ones that are not.
Where It Lives
Time Zone lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The machine is set to UK time, which is GMT in winter and BST in summer. Use it to convert local times, such as NetworkList dates, to UTC. |
| BST was in force when the hive was last written, so UTC is local time minus one hour. Use the offset for each artefact's own date, not only this one. |
| The winter offset is zero, as GMT equals UTC. Local times from winter dates need no change. |
| In summer the clocks go forward one hour. Local times from summer dates are one hour ahead of UTC. |
How to Read It
TimeZoneKeyName gives the zone, such as GMT Standard Time. ActiveTimeBias is the current offset from UTC in minutes, so UTC equals local time plus ActiveTimeBias. Bias plus DaylightBias gives the summer offset, and a zeroed DaylightStart means the zone has no daylight saving.
- When Windows Writes It
- When the zone or daylight saving state changes, by a user, by policy or by automatic time zone detection.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (timezone)
Hunt It
The time zone sits in this key, not in an event, so read it from the SYSTEM hive, offline or live with Velociraptor. The System log records each time or zone change, which covers earlier settings this key does not keep.
Defender device tables do not carry the time zone. Read the key with Velociraptor or from the SYSTEM hive.
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SYSTEM - Parse With
- Registry ExplorerRECmdRegRipper (timezone)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Time Zone shows.
- NetworkListGives local dates that, set against a UTC time such as a DHCP lease, show the offset in force that day.
- Time Changes in the System Event LogNot in the RegistryRecords earlier zone and clock changes, which this key does not keep.
Sources
The facts on this page come from these public pages, which say more on each point.