Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
DateDecoder
Datedecoder.exe allows you to convert various formats to their date/time value. It will also convert date/times to various outputs. It is used primarily to decode the date and time stamps from forensic analysis of systems. It supports most formats including: Unix Epoch, Window Filetime, OLE, Internet Explorer Cookies, email timestamps, mac HFS as well as many others.
The current list of supported values is:
Win128SysTime
Win64LE
Win64BE
Win32FileTime
MSDOS32FatTimeDate
MSDOS32FatDateTime
DosDateTime
OLEAutomation
CLRSystemTime
SQLString
SQLDateTime
SQLUptime
MSAccess
IECookie
HotmailTime
CID:EMail
ChromeWebKit
Chrome
Firefox
Safari
FlashCookie
UnixEpochTime
UnixMillsecondTime
UnixSecondTime
UnixLittleEndianTime
UnixBigEndianTime
MacLittleEndianHFS+
MacBigEndianHFS+
MacLittleEndianHFS
MacBigEndianHFS
IronPortEmailTime
JScriptDateObject
JavaDateTime
ActiveTimeBias
WinShutdownTime
WinInstallDate
RecycleBinTime
IISMailQTime
