From f747751b09a11f702c8215238dfb3c449e61a285 Mon Sep 17 00:00:00 2001
From: Janik Besendorf <janik@besendorf.org>
Date: Sat, 22 Aug 2026 14:16:24 +0200
Subject: [PATCH] Add timezone provenance to file timestamps

---
 .../modules/bugreport/fs_timestamps.py        | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/src/mvt/android/modules/bugreport/fs_timestamps.py b/src/mvt/android/modules/bugreport/fs_timestamps.py
index 5a2ca48..3c7e324 100644
--- a/src/mvt/android/modules/bugreport/fs_timestamps.py
+++ b/src/mvt/android/modules/bugreport/fs_timestamps.py
@@ -4,12 +4,15 @@
 #   https://license.mvt.re/1.1/
 
 import logging
+import datetime
 from typing import Optional
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from mvt.common.utils import convert_datetime_to_iso
 from .base import BugReportModule
 from mvt.common.module_types import ModuleResults
 from mvt.android.artifacts.file_timestamps import FileTimestampsArtifact
+from mvt.android.artifacts.getprop import GetProp
 
 
 class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
@@ -38,15 +41,44 @@ class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
     def run(self) -> None:
         filesystem_files = self._get_files_by_pattern("FS/*")
 
+        timezone_name = None
+        dumpstate = self._get_dumpstate_file()
+        if dumpstate:
+            section = self.extract_command_section(
+                dumpstate.decode("utf-8", errors="replace"),
+                "------ SYSTEM PROPERTIES",
+            )
+            properties = GetProp()
+            properties.parse(section)
+            timezone_name = properties.get_device_timezone()
+        timezone = None
+        if timezone_name:
+            try:
+                timezone = ZoneInfo(timezone_name)
+            except ZoneInfoNotFoundError:
+                self.log.warning("Unknown device timezone %s", timezone_name)
+
         self.results = []
         for file in filesystem_files:
             # Only the modification time is available in the zip file metadata.
             # The timezone is the local timezone of the machine the phone.
             modification_time = self._get_file_modification_time(file)
+            utc_time = None
+            if timezone is not None:
+                utc_time = convert_datetime_to_iso(
+                    modification_time.replace(tzinfo=timezone).astimezone(
+                        datetime.timezone.utc
+                    )
+                )
             self.results.append(
                 {
                     "path": file,
                     "modified_time": convert_datetime_to_iso(modification_time),
+                    "modified_time_utc": utc_time,
+                    "timezone": timezone_name,
+                    "timestamp_source": (
+                        "zip_metadata" if self.zip_archive else "filesystem_metadata"
+                    ),
                 }
             )