Windows Event Logs record timestamps in UTC (Coordinated Universal Time) format internally. This is a critical design choice that ensures consistency across systems in different time zones. When you view logs on the local machine, the Event Viewer automatically converts these UTC timestamps to your system's local time zone for display.

When you export event logs (using .evtx files) and open them on another machine, the behavior changes:

// Example PowerShell command to export logs
wevtutil epl System C:\temp\system_logs.evtx

The second machine will display the timestamps in its own local time zone, not the original machine's time zone. This conversion happens dynamically during viewing.

You can verify this behavior with a simple test:

1. Create a test event on Machine A (Time Zone: EST)
2. Export the log
3. Open on Machine B (Time Zone: PST)
4. Compare the displayed times

The event that occurred at 12:00 PM EST will show as 9:00 AM PST on the second machine.

If you need to process logs programmatically while preserving the original UTC timestamps, use tools like PowerShell:

# Get events with UTC timestamps
Get-WinEvent -Path C:\logs\exported.evtx | 
Select-Object TimeCreated, Id, Message |
Format-Table -AutoSize

• Always document the source machine's time zone when collecting logs
• Consider converting all timestamps to UTC in your analysis scripts
• Use the /-UTC parameter in wevtutil for consistent output

To include the original time zone information in your queries:

# XML query to get time zone information
$query = @'
<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[TimeCreated[timediff(@SystemTime) <= 3600000]]]</Select>
  </Query>
</QueryList>
'@
Get-WinEvent -FilterXml $query

Windows Event Logs store timestamps in Coordinated Universal Time (UTC) format, but display them according to the local system's time zone settings when viewed through Event Viewer. This behavior applies to both live logs and saved .evtx files.

When viewing logs:

// Example of how Windows converts UTC to local time
SYSTEMTIME utcTime = {2023, 12, 0, 15, 10, 30, 0, 0}; // UTC time
SYSTEMTIME localTime;
TzSpecificLocalTimeToSystemTime(NULL, &utcTime, &localTime);

When you save and transfer event logs:

• The raw UTC timestamps remain unchanged in the .evtx file
• Opening on a new machine will display times according to the second machine's time zone
• This can cause apparent time shifts when viewed across different time zones

Consider this PowerShell command to check time zone conversion:

Get-WinEvent -Path C:\logs\security.evtx -MaxEvents 1 | 
Select-Object TimeCreated, @{Name='UTCTime';Expression={$_.TimeCreated.ToUniversalTime()}}

When processing event logs programmatically:

// C# example for consistent UTC handling
EventLogQuery query = new EventLogQuery("Security", PathType.FilePath, "security.evtx");
query.ReverseDirection = true;
using (EventLogReader reader = new EventLogReader(query))
{
    EventRecord record = reader.ReadEvent();
    DateTime utcTime = record.TimeCreated.Value.ToUniversalTime();
}

1. Always store the original UTC timestamp when archiving logs
2. Include time zone information when displaying timestamps to users
3. Consider using NTP synchronization across all machines