Support Forums

Below is an updated version of the TimeZone.pl ProScript.  This one requires ProDiscover 4.85 or above.  The ProScript gets the ActiveTimeBias value from the TimeZoneInformation key, and that value can be used to modify times displayed in ProDiscover as local to the system, rather than UTC/GMT or local to the examiner's system (as it appears in the ProDiscover GUI).



#! c:\perl\bin\perl.exe
#-------------------------------------------------------------
# TimeZone.pl, version 0.1_20061026
# Copyright 2006 H. Carvey, keydet89@yahoo.com
#-------------------------------------------------------------
use ProScript;
PSDisplayText("TimeZone.pl v. 0.1_20061026");
PSDisplayText("ProScript to get the ActiveTimeBias Time Zone info from the Registry");
PSDisplayText("\n");
#-------------------------------------------------------------
# Get the ControlSet value
my %selectinfo = ();
my $current;
$numRegs = PSGetNumRegistries();
if ($numRegs == 0) {
    PSDisplayText("No registries to process");
    return;
}

$regName = PSGetRegistryAt(0);
PSRefreshRegistry($regName);
my $keyName = "HKEY_LOCAL_MACHINE\\System\\Select";
my $rHandle = PSOpenRegistry($regName, $keyName);

if ($rHandle == 0) {
    PSDisplayText("Unable to locate registry key");
    return;
}
else {
#    PSDisplayText("Registry opened succesfully.");
}

while (1) {
    $RegKeyInfo  = &ProScript::PSReadRegistry($rHandle);
  last if ($RegKeyInfo->{nType} == -1);
  next if ($RegKeyInfo->{nType} == PS_TYPE_KEY);
  my $value = $RegKeyInfo->{strRegName};
  my $data  = $RegKeyInfo->{strRawValueData};
  PSDisplayText($value." --> ".$data);
 
  $selectinfo{$value} = $data;
}
PSCloseHandle($rHandle);
#-------------------------------------------------------------
#

PSDisplayText("Current ControlSet = ".$selectinfo{Current});

my %tz = ();
my $keyName = "HKEY_LOCAL_MACHINE\\System\\ControlSet00".$selectinfo{Current}."\\Control\\TimeZoneInformation";
my $rHandle = PSOpenRegistry($regName, $keyName);

if ($rHandle == 0) {
    PSDisplayText("Unable to locate registry key");
    return;
}
else {
#    PSDisplayText("Registry opened succesfully.");
}

while (1) {
    $RegKeyInfo  = &ProScript::PSReadRegistry($rHandle);
    my $type = $RegKeyInfo->{nType};
  last if ($type == -1);
  next if ($type == PS_TYPE_KEY);
  my $value = $RegKeyInfo->{strRegName};
  my $data  = $RegKeyInfo->{strValueData};
#  PSDisplayText($value." --> ".$data." $type ");
 
  $tz{$value} = $data;
}
PSCloseHandle($rHandle);

my $temp = $tz{"ActiveTimeBias"};
my $t2 = (split(/\s/,$temp,2))[1];
$t2 =~ s/\(//;
$t2 =~ s/\)//;
PSDisplayText("ActiveTimeBias = ".$t2);