Security

Forensic Timestamp Decoder

Identify an unknown timestamp by decoding it as Windows FILETIME, Chrome WebKit, Apple Cocoa, HFS+, OLE, FAT and six more encodings at once.

Runs entirely in your browser, nothing is uploaded

Unknown timestamp value

Decimal or hex. Separators are ignored, and a 0xprefix is optional for values containing a–f.

How it works

1
The value is read as a number
Decimal and hexadecimal are both accepted, with or without a 0x prefix, and separators are ignored so a value copied out of a hex editor works as-is.
2
Every encoding is applied at once
Each format is defined by its own epoch and unit — 100-nanosecond ticks since 1601 for Windows FILETIME, microseconds since 1601 for Chrome, seconds since 2001 for Apple Cocoa — and the number is decoded through all of them.
3
Implausible readings are discarded
Every format will decode any number to some date, so only results landing between 1980 and 2100 are shown. The rest are counted but not listed, because a date in the year 47,000 is not a lead.

Practical guidance

More than one surviving reading is the normal outcome, not a failure. The magnitude of the number is the only evidence available here; where you found it is what identifies the encoding.
UTC is listed first because most of these formats define their epoch in UTC. The MS-DOS and FAT format is the exception — it stores no timezone, so treat those as wall-clock time from an unknown machine.
The encode direction is there for building a search filter or a test fixture in the format a tool actually expects.

People usually pair this with

Questions

How it works

The value is read as a number

Decimal and hexadecimal are both accepted, with or without a 0x prefix, and separators are ignored so a value copied out of a hex editor works as-is.

Every encoding is applied at once

Each format is defined by its own epoch and unit — 100-nanosecond ticks since 1601 for Windows FILETIME, microseconds since 1601 for Chrome, seconds since 2001 for Apple Cocoa — and the number is decoded through all of them.

Implausible readings are discarded

Every format will decode any number to some date, so only results landing between 1980 and 2100 are shown. The rest are counted but not listed, because a date in the year 47,000 is not a lead.

Practical guidance

More than one surviving reading is the normal outcome, not a failure. The magnitude of the number is the only evidence available here; where you found it is what identifies the encoding.
UTC is listed first because most of these formats define their epoch in UTC. The MS-DOS and FAT format is the exception — it stores no timezone, so treat those as wall-clock time from an unknown machine.
The encode direction is there for building a search filter or a test fixture in the format a tool actually expects.

Forensic Timestamp Decoder

How it works

The value is read as a number

Every encoding is applied at once

Implausible readings are discarded

Practical guidance

People usually pair this with

Unix Timestamp Converter

EXIF Metadata Viewer

File Metadata Inspector

Questions

Forensic Timestamp Decoder

How it works

The value is read as a number

Every encoding is applied at once

Implausible readings are discarded

Practical guidance

People usually pair this with

Unix Timestamp Converter

EXIF Metadata Viewer

File Metadata Inspector

Questions

Forensic Timestamp Decoder

How it works

The value is read as a number

Every encoding is applied at once

Implausible readings are discarded

Practical guidance

People usually pair this with

Unix Timestamp Converter

EXIF Metadata Viewer

File Metadata Inspector

Questions

Why do I get more than one plausible date?

Are these times UTC or local?

Forensic Timestamp Decoder

How it works

The value is read as a number

Every encoding is applied at once

Implausible readings are discarded

Practical guidance

People usually pair this with

Unix Timestamp Converter

EXIF Metadata Viewer

File Metadata Inspector

Questions

Why do I get more than one plausible date?

Are these times UTC or local?