search

digitalsleuth / time_decode

A timestamp and date decoder written for python 3
https://digitalsleuth.gitbook.io/time-decode-documentation/
MIT License
33 stars 8 forks source link

[CHROME] Incorrect timestamp generated during '--timestamp' #7

Closed digitalsleuth closed 2 years ago

digitalsleuth commented 2 years ago

When running tests, the command time-decode --timestamp "2021-09-18 18:35:04.029515" generated incorrect output for the Google Chrome timestamp:

Converting Date: 2021-09-18 18:35:04.029515

Unix Seconds:           1631990104
Unix Milliseconds:      1631990104029
Windows 64-bit Hex BE:      01d7acbbe5853cee
Windows 64-bit Hex LE:      ee3c85e5bbacd701
Google Chrome:          1327646370429515
Active Directory/LDAP dt:   132764637040295150
Unix Hex 32-bit BE:     61463158
Unix Hex 32-bit LE:     58314661
Windows Cookie Date:        3850419200,30911675
Windows OLE 64-bit double BE:   40e5b538c77e4050
Windows OLE 64-bit double LE:   50407ec738b5e540
Mac Absolute Time:      653682904
Mac OS/HFS+ Decimal Time:   3714834904
HFS/HFS+ 32-bit Hex BE:     dd6be1d8
HFS/HFS+ 32-bit Hex LE:     d8e16bdd
MS-DOS 32-bit Hex Value:    62943253
FAT Date + Time:        32536294
Microsoft 128-bit SYSTEMTIME:   e5070900060012001200230004001d00
Microsoft FILETIME time:    e5853cee:01d7acbb
Microsoft Hotmail time:     bbacd701:ee3c85e5
Mozilla PRTime:         1631990104029515
OLE Automation Date:        44457.774352193461
MS Excel 1904 Date:     42995.774352193461
iOS 11 Date:            653682904029515008
Symantec AV time:       330812122304
GPS time:           1316025322
Google EI time:         WDFGYQ
iOS Binary Plist time:      653682904
GSM time:           12908181534000
VMSD time:          379977,1315767808

Investigating cause now.

digitalsleuth commented 2 years ago

Chrome micro_seconds value was being stripped of leading zeroes, even when originally 6 digits long. Added zfill to avoid this issue from reoccurring.