Deconstruct 128-bit UUIDs and Microsoft GUIDs into their atomic components. Recover exact sub-microsecond creation timestamps from UUID v1, extract physical hardware IEEE 802 MAC addresses, query vendor OUIs, and transpose Little-Endian binary registry values.
Paste multiple UUIDs (from Registry dumps, LNK logs, NTFS $OBJECT_ID, or CSV reports) to generate an instant timeline.
| # | UUID / GUID | Version | UTC Creation Timestamp | Hardware MAC Address | OUI Vendor | Type |
|---|---|---|---|---|---|---|
| No batch data processed yet. Paste GUIDs above and click "Generate Forensic Timeline". | ||||||
In computer incident response, digital forensics, and criminal investigations, Universally Unique Identifiers (UUIDs) and Globally Unique Identifiers (GUIDs) serve as foundational pieces of forensic evidence. While modern specifications (such as UUID Version 4) rely on pseudo-random numbers, legacy specifications—especially UUID Version 1—were engineered using physical hardware identifiers and precise high-resolution timestamps.
Unlike random tokens, a UUID v1 provides two forensic anchor points that can prove user intent, link disparately seized storage drives, and confirm machine attribution:
When shortcut files (.lnk) or NTFS files with $OBJECT_ID attributes are created, Microsoft's Distributed Link Tracking Service assigns a Version 1 UUID containing the host computer's physical MAC address and creation second.
The 48-bit Node ID corresponds to the physical network card (NIC). The first 3 bytes form the Organizationally Unique Identifier (OUI), identifying the hardware manufacturer (such as Intel, Apple, Dell, or VMware).
Windows stores binary GUIDs in the Registry (Shellbags, UserAssist, CLSIDs) using mixed Little-Endian format (Data1, Data2, Data3 inverted). Converting raw bytes without byte-swapping causes invalid dates and phantom versions.
In 1999, the author of the Melissa virus was traced and arrested because Microsoft Word 97 documents generated internal GUIDs containing the author's physical network adapter MAC address.
| Version | Generation Method | Forensic Artifacts Recoverable | Investigative Value |
|---|---|---|---|
| UUID v1 | 60-bit Gregorian Time + 48-bit MAC | Sub-microsecond UTC creation time, physical MAC, vendor OUI | Extremely High |
| UUID v2 | DCE Security (POSIX UID/GID) | Local POSIX user/group ID and domain timestamp | High |
| UUID v3 | MD5 Hash over Namespace | Namespace correlation (deterministic hash) | Moderate |
| UUID v4 | Cryptographic PRNG (122 random bits) | Collision resistance only; zero timestamp or hardware data | Low |
| UUID v5 | SHA-1 Hash over Namespace | Namespace correlation (deterministic hash) | Moderate |
1 (making it a multicast address) and the remaining bits are randomized. If bit 0 is 0, it is guaranteed to be a genuine physical network adapter.