Solved

What kind of time format is "00 61 1E 8F 78 BC C9 01" in hex?

Posted on 2009-04-13
5
287 Views
Last Modified: 2012-05-06
I'm reading in a registry key in my Windows Mobile device that has the value of the "PasswordSetTime" which I am assuming is the time the current device password was set, but I don't know how to convert this to human time.

When read in backwards, they convert to values that look like they mean something (It looks a bit like epoch if the last 8 digits are truncated) but I can't seem to figure it out. These values were retrieved between a few minutes.
00 61 1E 8F 78 BC C9 01 => reversed and converted to decimal => 128,841,290,340,000,000

00 99 8D 7A 77 BC C9 01 => reversed and converted to decimal => 128,841,285,700,000,000

Anyone know what these numbers mean and how I can get the date from them? Thanks for any help!
0
Comment
Question by:Kanivorous
  • 3
5 Comments
 
LVL 50

Accepted Solution

by:
barry houdini earned 300 total points
ID: 24133295
Hello Kanivorous,
If you take the first 11 digits of the first of those numbers, i.e.
12,884,129,034
Then this would appear to be seconds from 1st January 1601
If you divide that number by 86400 (the number of seconds in a day) then you get this number
149,121.9
If you count days from 1st January 1601 (including leap days) then you get a date of 13th April 2009 at 20:43 (although you might need to adjust for time zones)
The 2nd time is therefore 464 seconds or 7:44 minutes earlier.
If you can determine the exact time for one then you should be able to get a fix on the others......
regards, barry
0
 
LVL 50

Expert Comment

by:barry houdini
ID: 24133352
.....I gather that the above time would be UTC (co-ordinated universal time). Pacific time would be UTC -8 hrs, i.e. the time would adjust to 16:43 on 13th April 2009 with a possible further adjustment for daylight saving......
0
 
LVL 32

Assisted Solution

by:aleghart
aleghart earned 200 total points
ID: 24133663
Barry beat me to it.

http://support.microsoft.com/kb/188768

Must convert starting from nanoseconds.  Not easy to calculate because Excel treats any date before 1/1/1900 differently.  For instance, 1/1/1601 becomes 1/1/3501.

From: http://www.microsoft.com/technet/scriptcenter/topics/win2003/lastlogon.mspx
Note. In case youre wondering, a number of years ago the American National Standards Institute (ANSI) adopted a system of counting days; this system began with December 31, 1600 as Day 0. In turn, that made January 1, 1601 the first official day in history, with all subsequent dates and times being based on the number of nanoseconds elapsed since the 0 hour on January 1, 1601. (That day was a Monday, by the way.) These so-called ANSI decimal dates were originally designed for use with the COBOL programming language and have continued to be used by Windows and other operating systems.
0
 
LVL 50

Expert Comment

by:barry houdini
ID: 24133838
....and just to correct an error in my second post.....
Of course if the UTC time/date is 13th April 2009 at 20:43 then UTC -8 is 12:43
regards, barry
0
 

Author Comment

by:Kanivorous
ID: 24134643
Thanks barry for the explanation and aleghart for the helpful links. That explanation in the link made my head spin and took a while to absorb.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

This article seeks to propel the full implementation of geothermal power plants in Mexico as a renewable energy source.
In this article we will discuss all things related to StageFright bug, the most vulnerable bug of android devices.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now