Closed digitalsleuth closed 2 years ago
When running tests, the command time-decode --timestamp "2021-09-18 18:35:04.029515" generated incorrect output for the Google Chrome timestamp:
time-decode --timestamp "2021-09-18 18:35:04.029515"
Converting Date: 2021-09-18 18:35:04.029515 Unix Seconds: 1631990104 Unix Milliseconds: 1631990104029 Windows 64-bit Hex BE: 01d7acbbe5853cee Windows 64-bit Hex LE: ee3c85e5bbacd701 Google Chrome: 1327646370429515 Active Directory/LDAP dt: 132764637040295150 Unix Hex 32-bit BE: 61463158 Unix Hex 32-bit LE: 58314661 Windows Cookie Date: 3850419200,30911675 Windows OLE 64-bit double BE: 40e5b538c77e4050 Windows OLE 64-bit double LE: 50407ec738b5e540 Mac Absolute Time: 653682904 Mac OS/HFS+ Decimal Time: 3714834904 HFS/HFS+ 32-bit Hex BE: dd6be1d8 HFS/HFS+ 32-bit Hex LE: d8e16bdd MS-DOS 32-bit Hex Value: 62943253 FAT Date + Time: 32536294 Microsoft 128-bit SYSTEMTIME: e5070900060012001200230004001d00 Microsoft FILETIME time: e5853cee:01d7acbb Microsoft Hotmail time: bbacd701:ee3c85e5 Mozilla PRTime: 1631990104029515 OLE Automation Date: 44457.774352193461 MS Excel 1904 Date: 42995.774352193461 iOS 11 Date: 653682904029515008 Symantec AV time: 330812122304 GPS time: 1316025322 Google EI time: WDFGYQ iOS Binary Plist time: 653682904 GSM time: 12908181534000 VMSD time: 379977,1315767808
Investigating cause now.
Chrome micro_seconds value was being stripped of leading zeroes, even when originally 6 digits long. Added zfill to avoid this issue from reoccurring.
When running tests, the command
time-decode --timestamp "2021-09-18 18:35:04.029515"
generated incorrect output for the Google Chrome timestamp:Investigating cause now.