Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

An app I was running crashed and I wanted to know when it happened, so I opened up the Windows event viewer and looked for an entry. I found the entry, and then noticed one of the details of the entry is this:

Faulting application start time: 0x01ccfe1e3e206d42

Cool, I thought, because I also wanted to know how long the app was executing. How do I decipher that string of hex and convert it into a date and time?

share|improve this question
add comment

2 Answers

That is a value that KeQuerySystemTime returns, and is stored in CreateTime of EPROCESS.

System time is a count of 100-nanosecond intervals since January 1, 1601.

NirSoft provides us with a look into the struct, it's the third property there; a large integer of 64-bit. Meaning it has an upper and a lower part which each are a 32-bit integer. Let's combine those...

01ccfe1e unsigned corresponds to 30211614, 3e206d42 unsigned corresponds to 1042312514.

Now, it's a matter of multiplying the earlier by 4,294,967,296 (+1) and adding the other value to it:

30211614 * 4294967296 + 1042312514 = 129757895131688258

We multiply by that value because it is the the amount of possible values of an unsigned 32-bit integer.

And we can verify our result with Wolfram Alpha (Thanks iglvzx); so, multiplied by 100 that gives us:

12975789513168825800 nanoseconds

And once we have these nanoseconds it's just some Wolfram Alpha magic, giving approximately:

411 years, 5 months, 15 days, 15 hours, 58 minutes, 33.17 seconds

Again using Wolfram Alpha magic we compute the correct date (thnx again) and then add the time to it:

6/16/2012; 15:58:33 GMT

Which tells me there is something odd going on with your computer's clock...


Extra: The last can also be done with Powershell, sadly it doesn't support large millisecond values:

PS C:> (new-object DateTime(1601,1,1,0,0,0,0)).AddYears(411).AddMonths(5).AddDays(15).AddHours(15).AddMinutes(58).AddSeconds(33)

Saturday, June 16, 2012 3:58:33 PM
share|improve this answer
1  
(new-object DateTime(1601,1,1,0,0,0,0)).AddSeconds(0x01ccfe1e3e206d42 / 10E+6) –  jon Z Jun 25 '12 at 12:01
    
This time represents the application start time in Utc. while the "date time" column in system event log represents local time, so to make it easier to figure out how long the applications lives, it's better to get the time both in Utc or Local: public static void RunSnippet() { DateTime start = new System.DateTime(1601,1,1,0,0,0, DateTimeKind.Utc); start += TimeSpan.FromSeconds( 0x01cd80f73328dc60 * 100.0 /1E9); Console.WriteLine( start.ToLocalTime() ); } –  zhaorufei Aug 23 '12 at 6:16
add comment
  1. In Powershell you could issue the following command:

    get-date 0x01ccfe1e3e206d42    
    

    replace 0x01ccfe1e3e206d42 with the value you found in your eventlog.

  2. Alternatively you could switch to the Details tab of the event properties where you will find the CreationTime in a human readable format. E.g. 2012-01-12T13:33:38.171Z

share|improve this answer
    
The method 1 is incorrect, the time span is 1601 years. In method 2 the "CreationTime" is the time when the event being logged, but in Utc time, it's not the application start time, the time when the event being logged is shown in the "Date and Time" column, measured in local time. –  zhaorufei Aug 23 '12 at 6:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.