Time in Signal
في هذه الصفحة
Every time in a run is in UTC, and every time says what it is: when an event was logged, when a process started, or only when Signal read a state.
UTC everywhere
All times in a run are UTC, written in ISO 8601 (2026-10-22T16:00:00Z). The host's time zone and its offset from UTC are in the run's host section (timezone, utc_offset_minutes), so you can convert to the host's local time when you need to.
What a time is: time_is
A time without its meaning can mislead. Every signal and every occurrence carries time_is, a few words saying what its time is:
| The time is |
|---|---|
event logged | When Windows wrote the log record. |
process started | When the process started. |
history file last written | When a PowerShell history file was last written - the command was typed at some time before. |
as of | Only when Signal read the host. The state was true then; when it became true is not recorded. |
States and their anchors
A state - a service configured, a task present, an exclusion set - is what Signal saw when it ran. Its time is as of the run. When Signal knows a time that dates it, it adds an anchor: a time and what that time is.
A registry key's last write.
An application's install date.
A file's creation time.
Ranges
Some evidence is known only within a range. A PowerShell history line was typed between the file's creation and its last write: it carries time_from and its time. Read it as "at some time in this range".
Times Windows writes without a zone
A few sources store a time without saying which zone it is in - some scheduled task times, for example. Signal does not guess: it says so beside the time.
Next
Learn how to point a run at an incident with a scoping profile.