Forensic Notes
Sign In Start Free Trial
Menu
Legacy Sign In

Forensic Timestamp Decoder

Decode forensic timestamps from 25+ formats.
Enter a single value or paste a block of text to auto-extract
and identify timestamps with confidence scoring.

lock 100% Client-Side Processing |cloud_off No Data Sent to Any Server |visibility_off Complete Privacy |code All Processing in Your Browser
|
Try:
Ctrl+Enter to decode
cloud_uploadDrag & drop file hereor
.pdf.docx.txt.json.html

How to Use This Timestamp Decoder

Whether you have a single value from a forensic image or an entire log file, this tool identifies and converts timestamps in seconds.

Decoding Timestamps: Step by Step

  1. 1

    Enter Your Data

    Paste a single timestamp value, a block of text containing multiple timestamps, or upload a file (PDF, Word, or plain text). The tool scans your input and extracts every potential timestamp automatically.

  2. 2

    Select Your Timezone

    Use the timezone dropdown or the quick-select buttons to choose your display timezone. All results show both UTC and your selected local time side by side.

  3. 3

    Click Decode

    Press the Decode button or use the Ctrl+Enter keyboard shortcut. The tool tests your input against 25+ timestamp formats and returns every valid interpretation.

  4. 4

    Read the Results

    Each result shows the format name, decoded dates in UTC and local time, and a confidence score (high, medium, or low). Click the info icon next to any format name for details about its epoch, formula, and where it is commonly found.

  5. 5

    Filter and Export

    Use the date range filter to focus on a specific time window. Copy individual values with the inline copy buttons, or export the full results table as a CSV file for your forensic report.

Encoding Dates: Step by Step

  1. 1

    Switch to Encode Mode

    Click the Encode toggle button at the top of the tool. This switches the interface from timestamp decoding to date encoding.

  2. 2

    Enter a Date and Time

    Use the date/time picker to select the date and time you want to convert. You can type directly into the field or use the calendar picker.

  3. 3

    View All Formats

    Click Encode to see your date represented in every supported timestamp format. Copy any value directly from the results table.

Why Encode Timestamps?

The Encode mode is not just for convenience. It serves critical purposes in forensic analysis and documentation.

verified

Verify Decoded Results

Round-trip verification is a best practice in forensics. Encode the decoded date back to its original format and confirm the output matches your input. If the values do not match, the format identification may be incorrect.

search

Build Search Queries for Evidence

When you know the date of an incident, encode it into the format used by the system you are investigating. Use the encoded value to search raw forensic images, registry hives, or SQLite databases in a hex editor or forensic tool.

description

Create Test Data and Documentation

Generate realistic timestamp values for test cases, validation scripts, forensic reports, and training materials. Having precise values in the correct format saves time and reduces errors in your documentation.

Supported Timestamp Formats (21)

Reference guide for all supported timestamp formats, their epochs, and where they are commonly found.

Seconds elapsed since the Unix epoch. The most common timestamp format in computing, used across nearly every operating system and programming language.

1970-01-01 00:00:00 UTC
Date = new Date(value * 1000)
10 digits (e.g. 1700000000)
Linux/macOS filesystems, most APIs, databases, log files
decimal

Milliseconds elapsed since the Unix epoch. Standard in JavaScript (Date.now()) and Java (System.currentTimeMillis()). Provides millisecond precision.

1970-01-01 00:00:00 UTC
Date = new Date(value)
13 digits (e.g. 1700000000000)
JavaScript Date.now(), Java System.currentTimeMillis(), MongoDB, Elasticsearch, Kafka, Cassandra
decimal

Microseconds elapsed since the Unix epoch. Also known as Mozilla PRTime in Firefox internals. Used in Python and PostgreSQL for high-precision timestamps.

1970-01-01 00:00:00 UTC
Date = new Date(value / 1000)
16 digits (e.g. 1700000000000000)
Python datetime, PostgreSQL, Firefox places.sqlite, cookies.sqlite, Thunderbird
decimal

100-nanosecond intervals since January 1, 1601 UTC. The standard timestamp format in Windows operating systems. Stored as a 64-bit value, often in little-endian byte order in raw hex.

1601-01-01 00:00:00 UTC
Date = new Date(value / 10000 - 11644473600000)
18 digits decimal or 16 hex chars (e.g. 133450000000000000)
NTFS, Windows Registry, Event Logs, Prefetch files, $MFT, $UsnJrnl
decimal, hex-le, hex-be

Microseconds since January 1, 1601 UTC. Used internally by Chromium-based browsers (Chrome, Edge, Brave, Opera) to store history, cookies, and bookmark timestamps in SQLite databases.

1601-01-01 00:00:00 UTC
Date = new Date(value / 1000 - 11644473600000)
17 digits (e.g. 13350000000000000)
Chrome History, Cookies, Downloads, Bookmarks (SQLite databases)
decimal

Seconds since January 1, 1904 UTC. The native timestamp format of the HFS+ (Mac OS Extended) filesystem. Stored as a 32-bit unsigned integer, limiting the range to dates before February 2040.

1904-01-01 00:00:00 UTC
Date = new Date((value - 2082844800) * 1000)
10 digits or 8 hex chars, 32-bit unsigned (max 4294967295)
HFS+ filesystem metadata, macOS disk images, Time Machine backups
decimal, hex-be

Seconds since January 1, 2001 UTC. The native date format for Apple platforms (NSDate in Objective-C, Date in Swift). Found throughout macOS and iOS application databases and plists.

2001-01-01 00:00:00 UTC
Date = new Date((value + 978307200) * 1000)
9 digits (e.g. 750000000)
macOS/iOS apps, Core Data databases, NSDate, iMessage, Safari
decimal

Packed 32-bit value encoding date and time in bit fields. Upper 16 bits: year (7 bits, offset 1980), month (4 bits), day (5 bits). Lower 16 bits: hour (5 bits), minute (6 bits), second/2 (5 bits). Seconds have 2-second resolution only.

1980-01-01 00:00:00
Year = ((value >> 25) & 0x7F) + 1980; Month = (value >> 21) & 0xF; Day = (value >> 16) & 0x1F; Hour = (value >> 11) & 0x1F; Min = (value >> 5) & 0x3F; Sec = (value & 0x1F) * 2
8 hex chars or decimal equivalent of 32-bit packed value
FAT12/16/32 filesystems, ZIP archives, USB drives, SD cards
decimal, hex-be

100-nanosecond intervals since January 1, 1601 UTC. Identical encoding to Windows FILETIME. Used in Active Directory LDAP attributes for account and policy timestamps.

1601-01-01 00:00:00 UTC
Date = new Date(value / 10000 - 11644473600000)
18 digits decimal (e.g. 133450000000000000)
Active Directory attributes (whenCreated, pwdLastSet, lastLogonTimestamp)
decimal

100-nanosecond intervals since January 1, 0001 in the proleptic Gregorian calendar. Used by .NET DateTime.Ticks property. The large epoch offset means values are very large numbers.

0001-01-01 00:00:00 UTC
Date = new Date((value - 621355968000000000) / 10000)
18-19 digits (e.g. 638000000000000000)
.NET DateTime.Ticks, C# applications, PowerShell, SQL Server datetime2
decimal

Seconds since January 6, 1980 (GPS epoch). GPS time does not include leap seconds, so it drifts ahead of UTC by the accumulated leap second count (currently 18 seconds).

1980-01-06 00:00:00 UTC
Date = new Date((value + 315964800) * 1000)
9-10 digits (e.g. 1400000000)
GPS devices, navigation logs, location data, NMEA output
decimal

Floating-point number representing days since December 30, 1899. The integer part counts whole days and the fractional part represents the time of day. Used extensively in Microsoft Office and COM programming.

1899-12-30 00:00:00
Date = new Date(-2209161600000 + value * 86400000)
Small numbers, typically 5 digits (e.g. 45000 = ~2023)
Microsoft Excel, VBA, COM/OLE objects, Access databases
float, decimal

100-nanosecond intervals since October 15, 1582 UTC, embedded within a UUID v1 string. The timestamp is split across three fields in the UUID: time_low (chars 1-8), time_mid (chars 9-12), and time_hi (chars 13-16, masked by version nibble "1").

1582-10-15 00:00:00 UTC
Extract 60-bit timestamp from UUID fields, then Date = new Date((timestamp - 122192928000000000) / 10000)
UUID string format: xxxxxxxx-xxxx-1xxx-xxxx-xxxxxxxxxxxx
UUIDs generated with v1 algorithm, databases, distributed systems
uuid

A distributed unique ID format where the timestamp is encoded in the upper 42 bits (after right-shifting by 22 bits). The lower 22 bits contain datacenter ID, worker ID, and sequence number. Also used by Discord.

2010-11-04 01:42:54.657 UTC
Date = new Date((value >> 22) + 1288834974657)
18-19 digits (e.g. 1829583040512)
Twitter/X tweet IDs, user IDs, Discord snowflake IDs
decimal

BCD-encoded timestamp used in SMS PDU (Protocol Data Unit) messages. Each byte stores two decimal digits with nibbles swapped. 7 bytes represent: year, month, day, hour, minute, second, and timezone offset.

N/A (absolute date in BCD)
Swap nibbles in each byte to get BCD digits: YY MM DD HH MM SS TZ
14 hex chars (7 bytes)
SMS PDU data, SIM card extractions, mobile forensics
hex-be

Packed bit-field datetime used in legacy Microsoft Word (.doc) binary format. Fields are packed into a 32-bit integer: minutes (6 bits), hours (5 bits), day (5 bits), month (4 bits), year-1900 (9 bits).

1900-01-01
Min = value & 0x3F; Hour = (value >> 6) & 0x1F; Day = (value >> 11) & 0x1F; Month = (value >> 16) & 0xF; Year = ((value >> 20) & 0x1FF) + 1900
4-8 hex chars (16-32 bit packed value)
Legacy Microsoft Word (.doc) file format metadata
decimal, hex-be

A 16-byte Windows API structure containing 8 WORD (16-bit) fields in order: year, month, dayOfWeek, day, hour, minute, second, millisecond. Commonly found in registry values and memory dumps.

N/A (absolute date)
Parse 8 little-endian 16-bit WORDs: [year][month][dow][day][hour][min][sec][ms]
32 hex chars (16 bytes)
Windows API structures, registry values, memory dumps
hex-le

Minutes (not seconds) since the Unix epoch, stored as a 32-bit big-endian hex value. Specific to Nokia Series 40 feature phones.

1970-01-01 00:00:00 UTC
Date = new Date(value * 60 * 1000)
8 hex chars (32-bit value)
Nokia Series 40 phones, feature phone forensics
hex-be

Unix seconds stored as a 32-bit big-endian hex value. Used in Motorola feature phones for call logs, SMS, and other timestamped records.

1970-01-01 00:00:00 UTC
Date = new Date(value * 1000)
8 hex chars (32-bit value)
Motorola feature phones, mobile forensic extractions
hex-be

Binary-coded decimal timestamp where each hex digit directly represents a decimal digit. Format: YYYYMMDDHHMMSS. Common in embedded systems and industrial equipment.

N/A (absolute date in BCD)
Read hex digits directly as decimal: 20231114221320 hex = 2023-11-14 22:13:20
12-14 hex chars (e.g. 20231114221320)
Embedded systems, PLC logs, SCADA systems, some mobile devices
hex-be

Base64-encoded Unix timestamp found in the "ei" parameter of Google search URLs. The first 4 bytes (decoded from base64) are a little-endian 32-bit Unix timestamp in seconds.

1970-01-01 00:00:00 UTC
Base64 decode, read first 4 bytes as little-endian uint32, then Date = new Date(value * 1000)
Base64 string (6+ characters)
Google search URLs (ei= parameter), browser history forensics
text

How to Decode Forensic Timestamps

Common timestamp formats encountered during digital forensic investigations, and how to interpret them.

Windows Registry Timestamps

Windows stores registry key "Last Write Time" values as 64-bit FILETIME timestamps: the number of 100-nanosecond intervals since January 1, 1601 UTC. These values appear in tools like Registry Explorer and RegRipper as large 18-digit decimal numbers or 16-character hex strings.

Where found: NTFS $MFT, $UsnJrnl, Prefetch files, Event Logs (.evtx), Amcache, SYSTEM/SAM/SOFTWARE hives.

How to decode: Divide the value by 10,000,000 to get seconds, then subtract the epoch offset of 11,644,473,600 seconds to convert to Unix time.

Chrome Browser Timestamps

Chromium-based browsers (Chrome, Edge, Brave, Opera) store timestamps in their SQLite databases as microseconds since January 1, 1601 UTC. This is similar to Windows FILETIME but in microseconds instead of 100-nanosecond intervals.

Where found: History, Cookies, Downloads, Login Data, Web Data, and Bookmarks SQLite files in the Chrome user profile directory.

How to decode: Divide the value by 1,000,000 to get seconds, then subtract 11,644,473,600 to convert to Unix time.

iPhone and macOS Timestamps

Apple platforms use two primary formats. HFS+ timestamps count seconds since January 1, 1904 UTC and appear in older macOS filesystem metadata. Cocoa/Core Data timestamps (NSDate) count seconds since January 1, 2001 UTC, and are found throughout iOS and macOS application databases.

Where found: iMessage (chat.db), Safari history, Photos.sqlite, Call History, Health data, Core Data stores, and plist files.

How to decode: For Cocoa timestamps, add 978,307,200 to convert to Unix seconds. For HFS+ timestamps, subtract 2,082,844,800 to convert to Unix seconds.

Linux Log Timestamps

Linux systems primarily use Unix timestamps: seconds since January 1, 1970 UTC. These 10-digit values are found in log files, cron jobs, filesystem metadata (ext4 inodes), and virtually every Linux application. Many modern systems also use millisecond or microsecond variants.

Where found: syslog, auth.log, wtmp/btmp, ext4 filesystem timestamps, SQLite databases, application logs, and systemd journal entries.

How to decode: Multiply by 1,000 to get milliseconds, then create a Date object. For 13-digit values (milliseconds), use directly. For 16-digit values (microseconds), divide by 1,000.

What Are Forensic Timestamps?

A timestamp is a numeric value that records when an event occurred. Every file you create, every website you visit, and every message you send generates timestamps that are stored by the operating system, browser, or application. In digital forensics, these values serve as critical evidence for reconstructing events and establishing facts.

The challenge is that different systems encode time in different ways. Some count seconds from 1970, others count 100-nanosecond intervals from 1601, and still others use proprietary formats with unique starting points. A single moment in time can appear as completely different numbers depending on the system that recorded it. Without the correct decoder, these values are meaningless strings of digits.

This tool supports more than 25 timestamp formats from six major categories, covering the most common encodings encountered in forensic investigations across desktop, mobile, and web platforms.

desktop_windows

Operating System Timestamps

Windows FILETIME, LDAP/Active Directory, and SYSTEMTIME formats used in NTFS, the Registry, and Event Logs.

terminal

Unix/Linux Timestamps

Epoch seconds, milliseconds, and microsecond variants found in log files, databases, and filesystem metadata.

laptop_mac

Apple Timestamps

HFS+ and Cocoa/Core Data formats used in macOS, iOS, iMessage, Safari, and Apple application databases.

language

Browser Timestamps

Chrome/WebKit microsecond timestamps and Google EI encoded values found in browsing history and cookies.

smartphone

Mobile Timestamps

GSM/3GPP, Nokia, and Motorola formats encountered in cell phone forensics and mobile device extractions.

build

Specialized Formats

FAT/DOS, .NET ticks, OLE Automation, GPS time, UUID v1, Snowflake IDs, BCD, and DTTM structures.

Why Timestamps Matter in Digital Forensics

Timestamps are among the most valuable artifacts in any digital investigation. They answer the fundamental question of "when" and connect isolated events into a coherent narrative.

timeline

Establishing Timelines

Forensic investigators reconstruct the sequence of events by correlating timestamps across multiple devices, accounts, and systems. File creation dates, login records, and communication logs all contribute to a unified timeline that reveals what happened and in what order.

gavel

Proving or Disproving Alibis

Timestamps from file metadata, GPS logs, login records, and browser history can place a person at a specific location or device at a specific time. This evidence is frequently used in court to corroborate or challenge statements made by witnesses and suspects.

security

Detecting Tampering

When someone attempts to alter or destroy digital evidence, timestamp inconsistencies often reveal the manipulation. Files with creation dates after their modification dates, or metadata timestamps that conflict with filesystem records, are strong indicators of tampering.

warning

Incident Response

During a security breach, timestamps are essential for determining when an attacker gained access, what systems were compromised, and how long the intrusion lasted. Accurate timeline analysis drives containment decisions and helps organizations understand the full scope of an incident.

Timestamp Decoder: Frequently Asked Questions

A timestamp decoder converts numeric or encoded timestamp values into human-readable dates and times. Different operating systems, browsers, and applications store timestamps in unique formats, each with its own starting point (epoch) and measurement unit. A decoder identifies the format and translates the raw value into a date you can understand and use in your investigation.

While DCode is a popular desktop tool for forensic timestamp decoding, this tool runs entirely in your browser with no software installation required. It supports 25+ formats with confidence scoring, can process bulk text or entire files to auto-extract timestamps, and provides a shareable URL for collaboration. DCode remains an excellent tool, and this decoder is designed as a modern, web-based complement to it.

Yes. All processing happens locally in your browser using JavaScript. No data is sent to any server, and nothing is stored or logged. You can verify this by using the tool with your network disconnected. This makes it safe to use with sensitive forensic evidence.

Each decoded result receives a high, medium, or low confidence score. High confidence means the input value strongly matches a specific format, typically with distinctive characteristics like the correct digit count and a plausible date range. Medium confidence means the value could match the format but also fits other patterns. Low confidence indicates a technically valid but unlikely interpretation.

Yes. You can upload PDF, Word (.docx), or plain text files (.txt, .log, .csv). The tool parses the file content locally in your browser, extracts all potential timestamp values, and decodes each one. This is useful for processing registry exports, log files, and forensic reports.

Unix time counts seconds since January 1, 1970 UTC, and is used by Linux, macOS, and most web services. Windows FILETIME counts 100-nanosecond intervals since January 1, 1601 UTC, and is used throughout the Windows operating system, including NTFS file systems and the Windows Registry. The different starting points and measurement units mean the same moment in time produces completely different numeric values in each format.

Paste the hex value directly into the input field, with or without the 0x prefix. The tool automatically detects hexadecimal input and tests it against all supported formats. This is common when working with raw registry data, filesystem metadata, or hex editor output.

Yes. After decoding, click the Share button in the results summary bar to copy a URL containing your input value. When a colleague opens the link, the tool automatically decodes the same value, saving time during collaborative analysis.

Streamline Your Investigations

This free tool is brought to you by Forensic Notes, the court-ready digital notetaking platform for investigators. Take your workflow to the next level.

Start Your Free TrialExplore Features