table of contents
TIME_DECODE(1) | User Commands | TIME_DECODE(1) |
NAME¶
time_decode - timestamp decoder and converter
DESCRIPTION¶
usage: time_decode [-h] [-g] [--guess TIMESTAMP] [--timestamp [DATE]]
- [--active] [--auto] [--biome64] [--biomehex] [--bitdate]
- [--bitdec] [--bplist] [--chrome] [--cookie] [--dhcp6] [--discord] [--dotnet] [--eitime] [--exfat] [--fat] [--ft] [--gbound] [--gmsgid] [--gps] [--gsm] [--hfsbe] [--hfsle] [--hfsdec] [--hotmail] [--iostime] [--ksdec] [--ksalnum] [--mac] [--mastodon] [--meta] [--moto] [--ms1904] [--msdos] [--nokia] [--nokiale] [--ns40] [--ns40le] [--nsdate] [--oleb] [--olel] [--pr] [--s32] [--sony] [--sym] [--systime] [--tiktok] [--twitter] [--uhbe] [--uhle] [--unix] [--umil] [--uu] [--vm] [--wh] [--whle] [--version]
Time Decoder and Converter v7.0.2 - supporting 55 timestamps!
Some timestamps are only part of the entire value, and as such, full timestamps may not be generated based on only the date/time portion.
options:¶
- -h, --help
- show this help message and exit
- -g, --gui
- launch the gui
- --guess TIMESTAMP
- guess the timestamp format and output possibilities
- --timestamp [DATE]
- convert date to every timestamp enter date as "YYYY-MM-DD HH:MM:SS.f" in 24h fmt Without DATE argument, will convert current date/time
- --active
- convert from Active Directory value
- --auto
- convert from OLE Automation Date format
- --biome64
- convert from an Apple Biome 64-bit decimal
- --biomehex
- convert from an Apple Biome hex value
- --bitdate
- convert from a Samsung/LG 4-byte value
- --bitdec
- convert from a bitwise decimal 10-digit value
- --bplist
- convert from an iOS Binary Plist value
- --chrome
- convert from Google Chrome value
- convert from Windows Cookie Date (Low,High)
- --dhcp6
- convert from a DHCP6 DUID value
- --discord
- convert from a Discord URL value
- --dotnet
- convert from a .NET DateTime value
- --eitime
- convert from a Google EI URL value
- --exfat
- convert from an exFAT 4-byte value
- --fat
- convert from FAT Date + Time (wFat)
- --ft
- convert from a FILETIME value
- --gbound
- convert from a GMail Boundary value
- --gmsgid
- convert from a GMail Message ID value
- --gps
- convert from a GPS value
- --gsm
- convert from a GSM value
- --hfsbe
- convert from HFS(+) BE (HFS=Local, HFS+=UTC)
- --hfsle
- convert from HFS(+) LE (HFS=Local, HFS+=UTC)
- --hfsdec
- convert from a Mac OS/HFS+ Decimal value
- --hotmail
- convert from a Hotmail value
- --iostime
- convert from an iOS 11 value
- --ksdec
- convert from a KSUID 9-digit value
- --ksalnum
- convert from a KSUID 27-character value
- --mac
- convert from Mac Absolute Time
- --mastodon
- convert from a Mastodon URL value
- --meta
- convert from a Metasploit Payload UUID
- --moto
- convert from Motorola's 6-byte value
- --ms1904
- convert from MS Excel 1904 Date format
- --msdos
- convert from 32-bit MS-DOS time, result is Local
- --nokia
- convert from a Nokia 4-byte value
- --nokiale
- convert from a Nokia 4-byte LE value
- --ns40
- convert from a Nokia S40 7-byte value
- --ns40le
- convert from a Nokia S40 7-byte LE value
- --nsdate
- convert from an Apple NSDate (iOS, BPList, Cocoa, Mac Absolute)
- --oleb
- convert from a Windows OLE 64-bit BE value, remove 0x & space - example from SRUM: 0x40e33f5d 0x97dfe8fb should be 40e33f5d97dfe8fb
- --olel
- convert from a Windows OLE 64-bit LE value
- --pr
- convert from Mozilla's PRTime
- --s32
- convert from an S32-encoded value
- --sony
- convert from a Sonyflake URL value
- --sym
- convert from Symantec's 6-byte AV value
- --systime
- convert from a 128-bit SYSTEMTIME value
- --tiktok
- convert from a TikTok URL value
- convert from a Twitter URL value
- --uhbe
- convert from Unix Hex 32-bit BE
- --uhle
- convert from Unix Hex 32-bit LE
- --unix
- convert from Unix Seconds
- --umil
- convert from Unix Milliseconds
- --uu
- convert from a UUID: 00000000-0000-0000-0000-000000000000
- --vm
- convert from a VMWare Snapshot (.vmsd) value - enter as "high value,low value"
- --wh
- convert from Windows 64-bit Hex BE
- --whle
- convert from Windows 64-bit Hex LE
- --version, -v
- show program's version number and exit
January 2024 | time_decode 7.0.2 |