TIME-DECODE(1)

NAME
Time-decode - timestamp decoder and converter

SYNOPSIS
time-decode [-h] [--unix] [--umil] [--wh] [--whle] [--chrome] [--active] [--uhbe] [--uhle] [--cookie] [--oleb] [--olel] [--mac] [--hfsdec] [--hfsbe] [--hfsle] [--fat] [--msdos] [--systime] [--ft] [--hotmail] [--pr] [--auto] [--ms1904] [--ios] [--sym] [--gps] [--eitime] [--bplist] [--gsm] [--vm] [--tiktok] [--twitter] [--discord] [--ksuid] [--mastodon] [--meta] [--sony] [--uu][--guess] [--timestamp [DATE]] [--version]

DESCRIPTION
time-decode provides the functionality to decode various timestamps and UUIDs to aid digital forensics and incident response processes. The supported formats range from common ones, like Unix epochs, WebKit/Chrome timestamps and Microsoft's FILETIME to more exotic formats like LDAP/Active Directory timestamps and Metasploit payload UUIDs. In addition, even timestamps used by some social media services, like Twitter, are included.

OPTIONS

-h, --help
    show this help message and exit

--unix UNIX
    convert from Unix Seconds

--umil UMIL
    convert from Unix Milliseconds

--wh WH
    convert from Windows 64-bit Hex BE

--whle WHLE
    convert from Windows 64-bit Hex LE

--chrome CHROME
    convert from Google Chrome time

--active ACTIVE
    convert from Active Directory value

--uhbe UHBE
    convert from Unix Hex 32-bit BE

--uhle UHLE
    convert from Unix Hex 32-bit LE

--cookie COOKIE
    convert from Windows Cookie Date (Low Value,High Value)

--oleb OLEB
    convert from Windows OLE 64-bit BE - remove 0x and spaces!
    example from SRUM: 0x40e33f5d 0x97dfe8fb should be 40e33f5d97dfe8fb

--olel OLEL
    convert from Windows OLE 64-bit LE

--mac MAC
    convert from Mac Absolute Time

--hfsdec HFSDEC
    convert from Mac OS/HFS+ Decimal Time

--hfsbe HFSBE
    convert from HFS(+) BE times (HFS = Local, HFS+ = UTC)

--hfsle HFSLE
    convert from HFS(+) LE times (HFS = Local, HFS+ = UTC)

--fat FAT
    convert from FAT Date + Time (wFat)

--msdos MSDOS
    convert from 32-bit MS-DOS time - result is Local Time

--systime SYSTIME
    convert from 128-bit SYSTEMTIME

--ft FT
    convert from FILETIME timestamp

--hotmail HOTMAIL
    convert from a Hotmail timestamp

--pr PR
    convert from Mozilla's PRTime

--auto AUTO
    convert from OLE Automation Date format

--ms1904 MS1904
    convert from MS Excel 1904 Date format

--ios IOS
    convert from iOS 11 timestamp

--sym SYM
    convert from Symantec's 12-byte AV timestamp

--gps GPS
    convert from a GPS timestamp

--eitime EITIME
    convert from a Google EI URL timestamp

--bplist BPLIST
    convert from an iOS Binary Plist timestamp

--gsm GSM
    convert from a GSM timestamp

--vm VM
    convert from a VMWare Snapshot (.vmsd) timestamp
    enter as "high value,low value"

--tiktok TIKTOK
    convert from a TikTok URL value

--twitter TWITTER
    convert from a Twitter URL value

--discord DISCORD
    convert from a Discord URL value

--ksuid KSUID
    convert from a KSUID value

--mastodon MASTODON
    convert from a Mastodon URL value

--meta META
    convert from a Metasploit Payload UUID

--sony SONY
    convert from a Sonyflake URL value

--uu UU
    convert from a UUID: 00000000-0000-0000-0000-000000000000

--guess GUESS
    guess timestamp and output all reasonable possibilities

--timestamp [DATE]
    convert date to every timestamp
    enter date as "YYYY-MM-DD HH:MM:SS.f" in 24h fmt.
    without any argument given, the current date/time will be converted

--version, -v
    show program's version number and exit

EXAMPLES
Guess the timestamp format and present most probable results

    time-decode --guess 1631902084

Convert multiple timestamps of different formats at once

    time-decode --unix 1631902084 --umil 1631951802869

Extract time from a UUID

    time-decode --uu b54adc00-67f9-11d9-9669-0800200c9a66

Convert the current datetime to all implemented timestamp formats

    time-decode --timestamp

Convert a specific datetime to all implemented timestamp formats

    time-decode --timestamp "2020-09-17 20:00:00.123"

AUTHORS
Written by Corey Forman

REPORTING BUGS
When submitting a bug report, please include a description of the problem, how you found it, and your contact information. Submit bug reports to: https://github.com/digitalsleuth/time_decode

COPYRIGHT
This project is licensed under terms of the MIT License - https://opensource.org/licenses/MIT. Copyright by Corey Forman

This manual page was written by Jan Gruber <j4n6ru@gmail.com>, for the Debian project (and may be used by others).

SEE ALSO
Additional information on time-decode appears in the README file, distributed with the time-decode source code.