NAME

       Time-decode - timestamp decoder and converter

SYNOPSIS

       time-decode  [-h]  [--unix]  [--umil]  [--wh] [--whle] [--chrome] [--active] [--uhbe] [--uhle] [--cookie]
       [--oleb] [--olel] [--mac] [--hfsdec] [--hfsbe] [--hfsle] [--fat] [--msdos] [--systime] [--ft] [--hotmail]
       [--pr] [--auto] [--ms1904] [--ios]  [--sym]  [--gps]  [--eitime]  [--bplist]  [--gsm]  [--vm]  [--tiktok]
       [--twitter]  [--discord]  [--ksuid]  [--mastodon]  [--meta] [--sony] [--uu][--guess] [--timestamp [DATE]]
       [--version]

DESCRIPTION

       time-decode provides the functionality to decode various timestamps and UUIDs to  aid  digital  forensics
       and  incident  response  processes.  The  supported  formats  range  from  common ones, like Unix epochs,
       WebKit/Chrome timestamps and Microsoft's FILETIME to  more  exotic  formats  like  LDAP/Active  Directory
       timestamps and Metasploit payload UUIDs. In addition, even timestamps used by some social media services,
       like Twitter, are included.

OPTIONS

       -h, --help
              show this help message and exit

       --unix UNIX
              convert from Unix Seconds

       --umil UMIL
              convert from Unix Milliseconds

       --wh WH
              convert from Windows 64-bit Hex BE

       --whle WHLE
              convert from Windows 64-bit Hex LE

       --chrome CHROME
              convert from Google Chrome time

       --active ACTIVE
              convert from Active Directory value

       --uhbe UHBE
              convert from Unix Hex 32-bit BE

       --uhle UHLE
              convert from Unix Hex 32-bit LE

       --cookie COOKIE
              convert from Windows Cookie Date (Low Value,High Value)

       --oleb OLEB
              convert from Windows OLE 64-bit BE - remove 0x and spaces!
              example from SRUM: 0x40e33f5d 0x97dfe8fb should be 40e33f5d97dfe8fb

       --olel OLEL
              convert from Windows OLE 64-bit LE

       --mac MAC
              convert from Mac Absolute Time

       --hfsdec HFSDEC
              convert from Mac OS/HFS+ Decimal Time

       --hfsbe HFSBE
              convert from HFS(+) BE times (HFS = Local, HFS+ = UTC)

       --hfsle HFSLE
              convert from HFS(+) LE times (HFS = Local, HFS+ = UTC)

       --fat FAT
              convert from FAT Date + Time (wFat)

       --msdos MSDOS
              convert from 32-bit MS-DOS time - result is Local Time

       --systime SYSTIME
              convert from 128-bit SYSTEMTIME

       --ft FT
              convert from FILETIME timestamp

       --hotmail HOTMAIL
              convert from a Hotmail timestamp

       --pr PR
              convert from Mozilla's PRTime

       --auto AUTO
              convert from OLE Automation Date format

       --ms1904 MS1904
              convert from MS Excel 1904 Date format

       --ios IOS
              convert from iOS 11 timestamp

       --sym SYM
              convert from Symantec's 12-byte AV timestamp

       --gps GPS
              convert from a GPS timestamp

       --eitime EITIME
              convert from a Google EI URL timestamp

       --bplist BPLIST
              convert from an iOS Binary Plist timestamp

       --gsm GSM
              convert from a GSM timestamp

       --vm VM
              convert from a VMWare Snapshot (.vmsd) timestamp
              enter as "high value,low value"

       --tiktok TIKTOK
              convert from a TikTok URL value

       --twitter TWITTER
              convert from a Twitter URL value

       --discord DISCORD
              convert from a Discord URL value

       --ksuid KSUID
              convert from a KSUID value

       --mastodon MASTODON
              convert from a Mastodon URL value

       --meta META
              convert from a Metasploit Payload UUID

       --sony SONY
              convert from a Sonyflake URL value

       --uu UU
              convert from a UUID: 00000000-0000-0000-0000-000000000000

       --guess GUESS
              guess timestamp and output all reasonable possibilities

       --timestamp [DATE]
              convert date to every timestamp
              enter date as "YYYY-MM-DD HH:MM:SS.f" in 24h fmt.
              without any argument given, the current date/time will be converted

       --version, -v
              show program's version number and exit

EXAMPLES

       Guess the timestamp format and present most probable results

              time-decode --guess 1631902084

       Convert multiple timestamps of different formats at once

              time-decode --unix 1631902084 --umil 1631951802869

       Extract time from a UUID

              time-decode --uu b54adc00-67f9-11d9-9669-0800200c9a66

       Convert the current datetime to all implemented timestamp formats

              time-decode --timestamp

       Convert a specific datetime to all implemented timestamp formats

              time-decode --timestamp "2020-09-17 20:00:00.123"

AUTHORS

       Written by Corey Forman

REPORTING BUGS

       When  submitting  a  bug  report, please include a description of the problem, how you found it, and your
       contact information.  Submit bug reports to: https://github.com/digitalsleuth/time_decode

COPYRIGHT

       This project is licensed under terms of the MIT License - https://opensource.org/licenses/MIT.  Copyright
       by Corey Forman

       This manual page was written by Jan Gruber <j4n6ru@gmail.com>, for the Debian project (and may be used by
       others).

SEE ALSO

       Additional information on time-decode appears in the README file, distributed with the time-decode source
       code.

Corey Forman                                    v3.1.1 - May 2021                                 TIME-DECODE(1)