7

An app I was running crashed and I wanted to know when it happened, so I opened up the Windows event viewer and looked for an entry. I found the entry, and then noticed one of the details of the entry is this:

Faulting application start time: 0x01ccfe1e3e206d42

Cool, I thought, because I also wanted to know how long the app was executing. How do I decipher that string of hex and convert it into a date and time?

4
  1. In Powershell you could issue the following command:

    get-date 0x01ccfe1e3e206d42    
    

    replace 0x01ccfe1e3e206d42 with the value you found in your eventlog.

  2. Alternatively you could switch to the Details tab of the event properties where you will find the CreationTime in a human readable format. E.g. 2012-01-12T13:33:38.171Z

| improve this answer | |
  • 1
    The method 1 is incorrect, the time span is 1601 years. In method 2 the "CreationTime" is the time when the event being logged, but in Utc time, it's not the application start time, the time when the event being logged is shown in the "Date and Time" column, measured in local time. – zhaorufei Aug 23 '12 at 6:20
3

In Powershell, issue the following command, replacing the hex sequence:

[datetime]::FromFileTime(0x01ccfe1e3e206d42)

9 March 2012, 19:58:33

The answer is in local time, to match times in Event Viewer (here in Finland we're 2 hours East of UTC in March). To show it in UTC time, add UTC to the method name:

[datetime]::FromFileTimeUTC(0x01ccfe1e3e206d42)

9 March 2012, 17:58:33
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.