> I'm a bit confused about this. AFIK the NTFS file system does not record the DST UTC offset in effect at the "event" time so how is it possible to reconstruct the true event time without figuring out what the UST offset was? Would you share what the "correct" APIs are to do this?
> ---End Quote---
> The magic call is SystemTimeToTzSpecificLocalTime(), which converts a UTC time (which is how timestamps are stored in NTFS) to a local time, taking into account the local timezone and whether or not DST was in force at that point in time.
>
I'm pretty sure that SystemTimeToTzSpecificLocalTime uses the current DST
setting for the specified zone rather than that of the time being converted.
Quoting from the MS help:
"The SystemTimeToTzSpecificLocalTime function takes into account whether
daylight saving time (DST) is in effect for the local time to which the system
time is to be converted."
No mention of historical DST value.
And this quote:
"The SystemTimeToTzSpecificLocalTime function may calculate the local time
incorrectly under the following conditions:
* The time zone uses a different UTC offset for the old and new years.
* The UTC time to be converted and the calculated local time are in
different years."
This implies an inability to adjust for different event and local time zones,
and no knowledge of historical DST settings.
Dennis