Decode and cross-convert raw binary, decimal, and hexadecimal timestamps encountered in NTFS MFT, registry hives, Chrome downloads, iOS SQLite, and Linux logs into synchronized UTC/local timelines with zero precision loss.
0x prefix, Unix seconds/milliseconds, or standard ISO timestamps.
pwdLastSet, accountExpires • NTDS.dit
In digital forensics and incident response (DFIR), constructing a reliable chronological timeline of events is often the single most critical factor in proving suspect culpability, tracking malware lateral movement, or discovering data exfiltration. However, operating systems and application databases do not store human-readable strings like "Oct 20, 2026 14:30". Instead, timestamps are stored as compact 32-bit or 64-bit integer counts since a designated epoch base date.
| Standard | Base Epoch Date | Granularity | Primary Forensic Artifacts |
|---|---|---|---|
| Windows FILETIME | January 1, 1601 UTC | 100 Nanoseconds (0.1 μs) | NTFS MFT ($SI, $FN), Registry keys, Prefetch (.pf), Shellbags, Event Logs. |
| Chrome WebKit / Blink | January 1, 1601 UTC | 1 Microsecond (μs) | Chrome/Edge/Brave History, Cookies, Download URL timestamps. |
| Unix Epoch | January 1, 1970 UTC | 1 Second / 1 Millisecond | Linux syslogs, auth.log, EXT4 inodes, Android SQLite, Apache access logs. |
| Apple Cocoa Core Data | January 1, 2001 UTC | 1 Second | iOS SMS (sms.db), Call history, Safari history, Apple Photos. |
| Apple Mac HFS+ | January 1, 1904 UTC | 1 Second | macOS HFS+ volume headers, catalog records, and allocation blocks. |
| MS-DOS FAT32 | January 1, 1980 Local | 2 Seconds | FAT12/FAT16/FAT32 directory entries on flash drives and SD cards. |
One of the primary techniques employed by attackers to hide their malware is timestomping (MITRE ATT&CK T1070.006). By executing API calls such as SetFileTime() in Windows, malware sets its modified, accessed, and created timestamps to match benign operating system executables (e.g. svchost.exe).
Forensic examiners detect timestomping through two primary indicators:
$STANDARD_INFORMATION (which user-mode APIs can modify) and $FILE_NAME (which only the Windows kernel updates when a file is renamed or moved). If $STANDARD_INFORMATION predates $FILE_NAME, the file was almost certainly timestomped!
133502856001234567). Many rudimentary timestomping utilities only set integer seconds, resulting in all trailing fractional digits resolving to ...0000000. A cluster of files with .0000000 nanosecond timestamps is an immediate forensic red flag.
BigInt. In JavaScript, standard Number is limited to 53 bits of integer precision (safe up to 9,007,199,254,740,991). Because 64-bit Windows FILETIME values frequently exceed 133 quadrillion, using standard floats causes catastrophic rounding errors of multiple seconds or minutes. BigInt guarantees exact bit-level arithmetic.
Unix_Milliseconds = (FILETIME - 116444736000000000n) / 10000n. The constant 116444736000000000 represents the number of 100-nanosecond intervals between January 1, 1601 and January 1, 1970. Dividing by 10,000 converts 100-nanosecond steps into milliseconds.