1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
### GPS Ref:
- http://www.leapsecond.com/java/gpsclock.htm
### Leap Seconds:
- https://www.nist.gov/pml/time-and-frequency-division/leap-seconds-faqs
- http://hpiers.obspm.fr/eop-pc/index.php?index=TAI-UTC_tab&lang=en
### Microsoft DateTime:
- https://docs.microsoft.com/en-us/dotnet/api/system.datetime?view=netframework-4.8
### Microsoft Time:
- https://docs.microsoft.com/en-ca/windows/win32/sysinfo/time
### Microsoft 1904 Timestamp:
- https://docs.microsoft.com/en-us/office/troubleshoot/excel/1900-and-1904-date-system
### Microsoft OLE Automation Date (OADate):
- https://docs.microsoft.com/en-us/dotnet/api/system.datetime.tooadate?view=netframework-4.8
### MSDOS wFatDate wFatTime DosDate:
- https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime
### Microsoft FILETIME:
- https://support.microsoft.com/en-ca/help/188768/info-working-with-the-filetime-structure
### Microsoft Active Directory/LDAP Timestamp:
- https://docs.microsoft.com/en-us/windows/win32/adschema/a-lastlogontimestamp
### bplist timestamp / Mac Absolute / iOS / Cocoa
- https://developer.apple.com/documentation/corefoundation/cfabsolutetime
- https://developer.apple.com/documentation/foundation/nsdate
### GSM Timestamps:
- https://en.wikipedia.org/wiki/GSM_03.40
- http://seven-bit-forensics.blogspot.com/2014/02/decoding-gsmsms-timestamps.html
### Symantec AV Timestamp:
- https://knowledge.broadcom.com/external/article/151245/interpreting-endpoint-protection-av-log.html
### VMWare Snapshot timestamp:
- https://stuffphilwrites.com/2013/03/vmware-snapshot-forensics/
### TikTok and Twitter Timestamps:
- https://dfir.blog/tinkering-with-tiktok-timestamps/
### Discord Timestamps:
- https://discord.com/developers/docs/reference#snowflakes
- Discord epoch is 1-1-2015 or 1420070400000
### KSUID Timestamp value:
- https://github.com/segmentio/ksuid
- https://github.com/obsidianforensics/unfurl
### Mastodon Social value:
- https://github.com/tootsuite/mastodon
### Metasploit Payload UUID format:
- https://github.com/rapid7/metasploit-framework/wiki/Payload-UUID
- https://github.com/DidierStevens/Beta/blob/master/metatool.py
### DHCPv6 DUID:
- https://tools.ietf.org/html/rfc3315#page-19
### Microsoft .NET DateTime Struct (not .NET Framework)
- https://docs.microsoft.com/en-us/dotnet/api/system.datetime?view=net-6.0
### GMail Boundary Timestamp
- https://www.metaspike.com/gmail-mime-boundary-delimiter-timestamps/
### GMail Message ID Timestamp
- https://www.metaspike.com/dates-gmail-message-id-thread-id-timestamps/
### Nokia Timestamp
- http://www.doubleblak.com/m/blogPosts.php?id=7#nokia
### Nokia S40 Timestamp
- https://sqliteforensictoolkit.com/a-brief-history-of-time-stamps/
### Bitwise Decimal Timestamp
- https://stackoverflow.com/questions/19185106/unknown-timestamp-reference-date/19553622#19553622
- Source of TS unknown, but since it's seemingly rare, it may be useful
### BitDate
- https://sqliteforensictoolkit.com/a-brief-history-of-time-stamps/
### Apple Biome data
- https://blog.d204n6.com/2022/09/ios-16-now-you-c-it-now-you-dont.html
### S32 encoding and decoding - BlueSky Social Network
- https://github.com/bluesky-social/atproto/blob/main/packages/common-web/src/tid.ts
- https://github.com/bluesky-social/atproto/blob/main/packages/common-web/src/util.ts
### Apache Cookie values
- https://github.com/apache/httpd/blob/trunk/modules/metadata/mod_usertrack.c#L99
### LEB128 hex value (thanks to Justin Lazenby for identifying this one!)
- https://en.wikipedia.org/wiki/LEB128
### Julian hex values
- https://stackoverflow.com/questions/56067745/hex-numbers-that-translate-into-date-and-time-stamps
### Julian decimal values
- https://github.com/seanredmond/juliandate/
### Semi-Octet value
- https://doubleblak.com/blogPost.php?k=timestamps#semioctet
|
