DateDecoder

From ForensicsWiki
Jump to: navigation, search

Datedecoder.exe allows you to convert various formats to their date/time value. It will also convert date/times to various outputs. It is used primarily to decode the date and time stamps from forensic analysis of systems. It supports most formats including: Unix Epoch, Window Filetime, OLE, Internet Explorer Cookies, email timestamps, mac HFS as well as many others.

The current list of supported values is:

Win128SysTime

Win64LE

Win64BE

Win32FileTime

MSDOS32FatTimeDate

MSDOS32FatDateTime

DosDateTime

OLEAutomation

CLRSystemTime

SQLString

SQLDateTime

SQLUptime

MSAccess

IECookie

HotmailTime

CID:EMail

ChromeWebKit

Chrome

Firefox

Safari

FlashCookie

UnixEpochTime

UnixMillsecondTime

UnixSecondTime

UnixLittleEndianTime

UnixBigEndianTime

MacLittleEndianHFS+

MacBigEndianHFS+

MacLittleEndianHFS

MacBigEndianHFS

IronPortEmailTime

JScriptDateObject

JavaDateTime

ActiveTimeBias

WinShutdownTime

WinInstallDate

RecycleBinTime

IISMailQTime