What kind of date stamp is this?

up vote
5
down vote

favorite

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

282

add a commentÂ |Â

up vote
5
down vote

favorite

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

282

add a commentÂ |Â

up vote
5
down vote

favorite

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

282

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

binary-format

asked Sep 7 at 4:23

Matt Hovey

282

asked Sep 7 at 4:23

Matt Hovey

282

asked Sep 7 at 4:23

Matt Hovey

282

asked Sep 7 at 4:23

Matt Hovey

282

asked Sep 7 at 4:23

Matt Hovey

282

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
7
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

5168

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "489"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2freverseengineering.stackexchange.com%2fquestions%2f19280%2fwhat-kind-of-date-stamp-is-this%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
7
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

5168

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

up vote
7
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

5168

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

up vote
7
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

5168

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

5168

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

5168

answered Sep 7 at 5:13

Abigail

5168

answered Sep 7 at 5:13

Abigail

5168

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

搜尋此網誌

Vtyjkyuk