Solved

Date Time conversions in python from a 64 bit timestamp.

Posted on 2010-11-27
5
1,614 Views
Last Modified: 2012-05-10

I am trying to convert a 64bit timestamp in to a human readable representation.

The last_visit_time field of the History.urls table in google-chromes History database is a 64bit timestamp.

The formula I use to convert to unix epoch time is :
   
             unixepochtime  =      last_visit_time / 10000000L
             datetime.datetime.fromtimestamp ( unixepochtime)


The date I get is 30 days and approximately 18 hours into the future.  

I am sure that I am doing something wrong. Something obvious but I fail to see it.  

Any ideas?



0
Comment
Question by:geldfeld
5 Comments
 
LVL 16

Expert Comment

by:gelonida
ID: 34223661
Does this help?

http://stackoverflow.com/questions/2193820/convert-chrome-history-date-time-stamp-to-readable-format

I do not have time stamp values to test.
I also don't know whether the start date iin above link is really fine.

If you had two time stamp values with a know time distance and you know what the times should be
one could reconstruct the formula.
0
 
LVL 2

Accepted Solution

by:
markoilic earned 500 total points
ID: 34223798
Hi,

try this;

datetime.datetime(1601, 1, 1) + datetime.timedelta(microseconds=last_visit_time)
0
 

Author Closing Comment

by:geldfeld
ID: 34224185
Worked beautifully.  I tested it on pages I had browsed waking up this morning.  


>>> datetime.datetime(1601,1,1) + datetime.timedelta (microseconds=12935395536392785)
datetime.datetime(2010, 11, 28, 5, 25, 36, 392785)
0
 

Author Comment

by:geldfeld
ID: 34224193
@gelonida:

Thanks for the response.
That was my initial approach; after I reconstructed the formula incorrectly is how I got into this mess
.
0
 
LVL 62

Expert Comment

by:btan
ID: 34224249
This link should simplify the computation as it applies quite similarly for Chrome but with some tweaks, note two points
a) there is a time zone parameter factored in the code, can remove it since your formatting already factor in the locale time
b) need some 'cleaning' on the "last_visit_time" param from the "urls" sqlite table before using in the formula
 
@ http://efreedom.com/Question/1-2141537/Convert-Datetime-Fields-Chrome-History-File-Sqlite-Readable-Format

Note that Chrome is not consistent with which datetime format it uses, some tables (like Firefox) use standard Unix Epoch time (microseconds since 1st January 1970) whilst in others (like Chrome) it uses its own variation of Windows Filetime (100 nanosecond intervals since 1st January, 1601 UTC) but divided by 10 to give the number of microseconds.

These sites are good references if interested
@ http://www.epochconverter.com/
@ http://docs.python.org/library/time.html
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How does one repair damaged jpg files 9 160
Export Table to CSV - Access to CSV - using python 18 101
Difference of import usage in Python 1 62
yara deployment 8 33
Installing Python 2.7.3 version on Windows operating system For installing Python first we need to download Python's latest version from URL" www.python.org " You can also get information on Python scripting language from the above mentioned we…
The foremost challenge encountered by an investigator at the very beginning of a forensics investigation is, accessing a file/data to read/view its contents. Owing to the fact, a platform is necessary for both; opening as well as examining any file.…
Learn the basics of strings in Python: declaration, operations, indices, and slicing. Strings are declared with quotations; for example: s = "string": Strings are immutable.: Strings may be concatenated or multiplied using the addition and multiplic…
Learn the basics of modules and packages in Python. Every Python file is a module, ending in the suffix: .py: Modules are a collection of functions and variables.: Packages are a collection of modules.: Module functions and variables are accessed us…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now