Zoom computer artifact timestamps

[Calvin1]

I am trying to figure out why Zoom meeting timestamps in a PC are not matching up with actual meeting times.   Is the timestamp that is recorded from the HQ timezone timestamp or is it the local machine's timestamp in it's respective timezone?

[ZoomTestKitchen]

Your post/question caused me to check into this, and when I did I found that if I recorded a scheduled meeting, the recording with timestamp would be correct, but when I recorded a PMI (Personal Meeting ID) meeting the recorded timestamp was wrong. I am in the central time zone and it was displaying eastern time.

So, I got on the phone with Zoom Support, which by the way is fantastic, I'm spoiled having an enterprise account, but we did further testing.

First... the assumption is that timestamps derive their time zone information from our Zoom Profile. And although my scheduled meetings seemed to be doing this accurately, my PMI meetings were not. So, after 30 minutes of testing we decided to change my time zone in my profile to a different location, and then change it back. And low and behold it fixed the discrepancy. All my timestamps are now correct.

I'm hopeful that these findings will also help you and others. Thanks for the post, as it inspired a research project on my end.

Here is the response from Marco in support.

Marco (Zoom)

Oct 5, 2022, 16:15 CDT

Hi Jeff,

This is Marco again from Zoom Support. I appreciate your time in our call.
As discussed, I will definitely inform our backend about this bug that we've just discovered.
Thank you for allowing me to assist. If anything arises, feel free to call us back.

Thank you for choosing Zoom!

Have a good one and stay safe!

Best regards,
Marco

[Calvin1]

Thank you so much for jumping into testing and taking steps to getting things fixed.  My problem has nothing to do with recording Zoom meetings.  I do digital forensics and use digital forensic software.  I am talking about the timestamps in browser logs, in this particular case Chrome.  Let me give you a short description:

I am in Montreal, in my forensics lab (GMT -5 or -4 for daylight savings) .  My evidence is off a computer that was used in  Manitoba (GMT -6 or -5 for daylight savings).   The Zoom meeting in question took place with all users in Manitoba at approximately 19:00 in May (GMT -6).       Data is read from the computer in GMT 0 and would have to be converted to the timezone that the computer was in.  The forensic software has a function where you input the timezone where the machine belongs.  I set it at GMT -6. The evidence shows that the meeting was held at 16:00.  It should read as 19:00.  I have a 3 hour difference that I am trying to figure out.  I suspect that perhaps the computer itself was adjusted for daylight savings time manually instead of using the Windows "adjust for daylight savings time" and  was not changed back.  I also suspect that Chrome is recording the timestamp as the time taken from Zoom's servers in California (GMT -8 or -7 for DST).  If this is true then my evidence would match what really took place.  I suspect that if we have international Zoom meetings, the server would have timestamps from different timezones reporting 2 different times for the same connection and therefore cause problems.  A way to correct this would be to simply use Zoom's server time and therefore you would not have complications due to the timestamp.    I will return back to the evidence and check out the registry settings to make sure it  was set on GMT -6 and that "auto daylight savings" was on.

[ZoomTestKitchen]

The timestamp in Zoom would be derived from the Zoom Account profile section of the person who created and hosted the meeting. Then you'd want to also confirm the date/time and timezone on the PC itself.