TIME_DECODE(1)

NAME
time_decode - timestamp decoder and converter

DESCRIPTION
usage: time_decode [-h] [-g] [--guess TIMESTAMP] [--timestamp [DATE]]

[--active] [--auto] [--biome64] [--biomehex] [--bitdate]
    [--bitdec] [--bplist] [--chrome] [--cookie] [--dhcp6] [--discord] [--dotnet] [--eitime] [--exfat] [--fat] [--ft] [--gbound] [--gmsgid] [--gps] [--gsm] [--hfsbe] [--hfsle] [--hfsdec] [--hotmail] [--iostime] [--ksdec] [--ksalnum] [--mac] [--mastodon] [--meta] [--moto] [--ms1904] [--msdos] [--nokia] [--nokiale] [--ns40] [--ns40le] [--nsdate] [--oleb] [--olel] [--pr] [--s32] [--sony] [--sym] [--systime] [--tiktok] [--twitter] [--uhbe] [--uhle] [--unix] [--umil] [--uu] [--vm] [--wh] [--whle] [--version]

Time Decoder and Converter v7.0.2 - supporting 55 timestamps!

Some timestamps are only part of the entire value, and as such, full timestamps may not be generated based on only the date/time portion.

  options:

-h, --help
    show this help message and exit

-g, --gui
    launch the gui

--guess TIMESTAMP
    guess the timestamp format and output possibilities

--timestamp [DATE]
    convert date to every timestamp enter date as "YYYY-MM-DD HH:MM:SS.f" in 24h fmt Without DATE argument, will convert current date/time

--active
    convert from Active Directory value

--auto
    convert from OLE Automation Date format

--biome64
    convert from an Apple Biome 64-bit decimal

--biomehex
    convert from an Apple Biome hex value

--bitdate
    convert from a Samsung/LG 4-byte value

--bitdec
    convert from a bitwise decimal 10-digit value

--bplist
    convert from an iOS Binary Plist value

--chrome
    convert from Google Chrome value

--cookie
    convert from Windows Cookie Date (Low,High)

--dhcp6
    convert from a DHCP6 DUID value

--discord
    convert from a Discord URL value

--dotnet
    convert from a .NET DateTime value

--eitime
    convert from a Google EI URL value

--exfat
    convert from an exFAT 4-byte value

--fat
    convert from FAT Date + Time (wFat)

--ft
    convert from a FILETIME value

--gbound
    convert from a GMail Boundary value

--gmsgid
    convert from a GMail Message ID value

--gps
    convert from a GPS value

--gsm
    convert from a GSM value

--hfsbe
    convert from HFS(+) BE (HFS=Local, HFS+=UTC)

--hfsle
    convert from HFS(+) LE (HFS=Local, HFS+=UTC)

--hfsdec
    convert from a Mac OS/HFS+ Decimal value

--hotmail
    convert from a Hotmail value

--iostime
    convert from an iOS 11 value

--ksdec
    convert from a KSUID 9-digit value

--ksalnum
    convert from a KSUID 27-character value

--mac
    convert from Mac Absolute Time

--mastodon
    convert from a Mastodon URL value

--meta
    convert from a Metasploit Payload UUID

--moto
    convert from Motorola's 6-byte value

--ms1904
    convert from MS Excel 1904 Date format

--msdos
    convert from 32-bit MS-DOS time, result is Local

--nokia
    convert from a Nokia 4-byte value

--nokiale
    convert from a Nokia 4-byte LE value

--ns40
    convert from a Nokia S40 7-byte value

--ns40le
    convert from a Nokia S40 7-byte LE value

--nsdate
    convert from an Apple NSDate (iOS, BPList, Cocoa, Mac Absolute)

--oleb
    convert from a Windows OLE 64-bit BE value, remove 0x & space - example from SRUM: 0x40e33f5d 0x97dfe8fb should be 40e33f5d97dfe8fb

--olel
    convert from a Windows OLE 64-bit LE value

--pr
    convert from Mozilla's PRTime

--s32
    convert from an S32-encoded value

--sony
    convert from a Sonyflake URL value

--sym
    convert from Symantec's 6-byte AV value

--systime
    convert from a 128-bit SYSTEMTIME value

--tiktok
    convert from a TikTok URL value

--twitter
    convert from a Twitter URL value

--uhbe
    convert from Unix Hex 32-bit BE

--uhle
    convert from Unix Hex 32-bit LE

--unix
    convert from Unix Seconds

--umil
    convert from Unix Milliseconds

--uu
    convert from a UUID: 00000000-0000-0000-0000-000000000000

--vm
    convert from a VMWare Snapshot (.vmsd) value - enter as "high value,low value"

--wh
    convert from Windows 64-bit Hex BE

--whle
    convert from Windows 64-bit Hex LE

--version, -v
    show program's version number and exit