I am using EnCase and a Hex Editor to analyse a virtual drive.

EnCase says that the this hexadecimal: 5FBF60C54F2CCF01

is the date/time (mm/dd/yy): 02/17/14 09:18:54 (PM)

I have worked out date/times successfully before, but can't match up the above.

If someone could confirm EnCase is correct and explain it to me, that would be splendid.

  • 1
    ...what's a "MAC time"?
    – user1686
    Jan 21 '15 at 21:21
  • Modified, Accessed and Created.
    – Andrew
    Jan 21 '15 at 21:23

Se here. ("Interpretation of NTFS Timestamps", from forensicfocus.com)

NTFS file timestamps, according to the documentation of the ‘FILETIME’ data structure in the Windows Software Development Toolkit, is a “64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC)”.

Conversion from this internal format to a format more suitable for human interpretation is performed by the Windows system call FileTimeToSystemTime(), which extracts the year, month, day, hour, minutes, seconds and milliseconds from the timestamp data. On other platforms (e.g. Unix), or in software that is intentionally platform-independent (e.g. Perl or Java) other methods for translation is be required.

The documentation of FileTimeToSystemTime(), as well as practical tests, indicate that the FILETIME value to be translated must be 0x7FFFFFFFFFFFFFFF or less. This corresponds to the time 30828-09-14 02:48:05.4775807.

(etc. etc.)

/edit: Though your date would amount to Saturday, Feb 20th of the year 23464 (no typo). Is your NTFS possibly busted?

(Here's a calculator. Use the "filetime" setting, and be sure to enter your numbers in decimal form.)

  • Yeah I found the above too, but it just doesn't add up with the data I have. The quoted hex and date isn't actually mine, but mine doesn't add up either. It would be fine just to accept that it is correct, but I am trying to find an explanation, so I can manually carve the date myself.
    – Andrew
    Jan 22 '15 at 10:11
  • Having spoken with others about this, this is the correct method, the hex string that I had needed to be converted to Little Endian (basically reversed) before being put into this conversion tool. Having done that, the correct date/time should become apparent.
    – Andrew
    Jan 26 '15 at 12:55

You can solve the puzzle in WinDbg. Just start any program and attach to it.

Then, write your data somewhere into memory:

0:001> eq 7731000c  5FBF60C54F2CCF01

and interpret it as ole32!FILETIME

0:001> dt ole32!FILETIME 7731000c  
 Feb 20 16:57:50 23464
   +0x000 dwLowDateTime    : 0x4f2ccf01
   +0x004 dwHighDateTime   : 0x5fbf60c5

As you can see, it is far in the future.

However, it is likely that EnCase display the values byte-wise as written on disk, so you have a LSB/MSB issue. Let's enter the data byte-wise:

0:001> eb 7731000c 5F BF 60 C5 4F 2C CF 01

Output in 64 bit format, notice that the bytes are in reverse order now.

0:001> dq 7731000c  L1
7731000c  01cf2c4f`c560bf5f

Interpret as FILETIME:

0:001> dt ole32!FILETIME 7731000c
 Feb 18 02:18:54 2014
   +0x000 dwLowDateTime    : 0xc560bf5f
   +0x004 dwHighDateTime   : 0x1cf2c4f

Not sure why it is off by a few hours, though. Perhaps that's a time zone issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.