Ufdjrw

Could a dragon use its wings to swim?

Is it correct to say moon starry nights?

Is it convenient to ask the journal's editor for two additional days to complete a review?

Why did early computer designers eschew integers?

Aggressive Under-Indexing and no data for missing index

Is it okay to majorly distort historical facts while writing a fiction story?

Calculate the Mean mean of two numbers

Traveling with my 5 year old daughter (as the father) without the mother from Germany to Mexico

Man transported from Alternate World into ours by a Neutrino Detector

Won the lottery - how do I keep the money?

vector calculus integration identity problem

How to use ReplaceAll on an expression that contains a rule

Strange use of "whether ... than ..." in official text

The Ultimate Number Sequence Puzzle

Is a distribution that is normal, but highly skewed, considered Gaussian?

Is it professional to write unrelated content in an almost-empty email?

(How) Could a medieval fantasy world survive a magic-induced "nuclear winter"?

Spaces in which all closed sets are regular closed

What difference does it make using sed with/without whitespaces?

Is there a way to save my career from absolute disaster?

Is it OK to decorate a log book cover?

free fall ellipse or parabola?

Do I need to write [sic] when including a quotation with a number less than 10 that isn't written out?

My ex-girlfriend uses my Apple ID to login to her iPad, do I have to give her my Apple ID password to reset it?

Convert local epoch 1970 in seconds time to UTC time

-1

I am trying to get the deletion time out of a Recycle.Bin $I file. The returned timestamp is in local time (Pacific Daylight Time (-700)). The timestamp is correct but I want it in UTC. I am having difficulty in figuring this out. Reference:
https://4n6xplorer.com/forensics/once-upon-a-time-in-recycle-bin/

import os
import time
import datetime

filename = "$IU0OUS4.txt"
with open(filename, 'rb') as f:
 bindata = f.read()
f.close()

del_time = bindata[16:24]
print("binary output(bytes 16:23): " + str(del_time))

int_epoch_1601_ns = int.from_bytes(del_time, byteorder = 'little')
print("Epoch 1601 in nanoseconds: " + str(int_epoch_1601_ns))

int_epoch_1601_seconds = int((int_epoch_1601_ns * 100) / 1000000000)
print("Epoch 1601 in seconds: " + str(int_epoch_1601_seconds))

#fudge_factor - diff between epochs - 1/1/1601 and 1/1/1970 
fudge_factor = -11644516800

int_epoch_1970_seconds = fudge_factor + int_epoch_1601_seconds
print("Epoch 1970 in seconds: " + str(int_epoch_1970_seconds))

delete_timestamp = time.ctime(int_epoch_1970_seconds) # generate timestamp
print("File deleted: " + delete_timestamp)

OUTPUT

binary output(bytes 16:23): b'xe0zx1c1xee`xd4x01'
Epoch 1601 in nanoseconds: 131836865243020000
Epoch 1601 in seconds: 13183686524
Epoch 1970 in seconds: 1539169724
File deleted: Wed Oct 10 04:08:44 2018

python datetime

share|improve this question

edited Mar 13 at 20:24

Damonv2

asked Mar 7 at 18:17

Damonv2Damonv2

12

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What's your reference for the file format?
  
  – Lightness Races in Orbit
  Mar 7 at 19:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Windows 10 text file format
  
  – Damonv2
  Mar 7 at 20:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  More detail please
  
  – Lightness Races in Orbit
  Mar 8 at 0:48
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I am confused of what you are asking for. This script manually pulls the time from bit 16 to bit 23 in little Endian in epoch 1601 time. I then converted it to be in epoch 1970 but the time is in local time. I would much rather have it in UTC time knowing that I am in pacific time as a variable. Is there a function to convert the 1970 epoch local time to UTC time? This file is a $I (deleted) text file from a Windows 10 Recycle.Bin.
  
  – Damonv2
  Mar 8 at 21:22
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What was confusing about my question? I am asking how you determined the format of the file you're parsing. You can provide a citation/reference. Then, together, we can go through it and find a solution to your problem. I don't comprehend how the phrase "Windows 10 text file format" helps to further that goal.
  
  – Lightness Races in Orbit
  Mar 9 at 3:16
  
  

  
  
  
  

 | 
show 2 more comments

-1

I am trying to get the deletion time out of a Recycle.Bin $I file. The returned timestamp is in local time (Pacific Daylight Time (-700)). The timestamp is correct but I want it in UTC. I am having difficulty in figuring this out. Reference:
https://4n6xplorer.com/forensics/once-upon-a-time-in-recycle-bin/

import os
import time
import datetime

filename = "$IU0OUS4.txt"
with open(filename, 'rb') as f:
 bindata = f.read()
f.close()

del_time = bindata[16:24]
print("binary output(bytes 16:23): " + str(del_time))

int_epoch_1601_ns = int.from_bytes(del_time, byteorder = 'little')
print("Epoch 1601 in nanoseconds: " + str(int_epoch_1601_ns))

int_epoch_1601_seconds = int((int_epoch_1601_ns * 100) / 1000000000)
print("Epoch 1601 in seconds: " + str(int_epoch_1601_seconds))

#fudge_factor - diff between epochs - 1/1/1601 and 1/1/1970 
fudge_factor = -11644516800

int_epoch_1970_seconds = fudge_factor + int_epoch_1601_seconds
print("Epoch 1970 in seconds: " + str(int_epoch_1970_seconds))

delete_timestamp = time.ctime(int_epoch_1970_seconds) # generate timestamp
print("File deleted: " + delete_timestamp)

OUTPUT

binary output(bytes 16:23): b'xe0zx1c1xee`xd4x01'
Epoch 1601 in nanoseconds: 131836865243020000
Epoch 1601 in seconds: 13183686524
Epoch 1970 in seconds: 1539169724
File deleted: Wed Oct 10 04:08:44 2018

python datetime

share|improve this question

edited Mar 13 at 20:24

Damonv2

asked Mar 7 at 18:17

Damonv2Damonv2

12

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What's your reference for the file format?
  
  – Lightness Races in Orbit
  Mar 7 at 19:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Windows 10 text file format
  
  – Damonv2
  Mar 7 at 20:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  More detail please
  
  – Lightness Races in Orbit
  Mar 8 at 0:48
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I am confused of what you are asking for. This script manually pulls the time from bit 16 to bit 23 in little Endian in epoch 1601 time. I then converted it to be in epoch 1970 but the time is in local time. I would much rather have it in UTC time knowing that I am in pacific time as a variable. Is there a function to convert the 1970 epoch local time to UTC time? This file is a $I (deleted) text file from a Windows 10 Recycle.Bin.
  
  – Damonv2
  Mar 8 at 21:22
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What was confusing about my question? I am asking how you determined the format of the file you're parsing. You can provide a citation/reference. Then, together, we can go through it and find a solution to your problem. I don't comprehend how the phrase "Windows 10 text file format" helps to further that goal.
  
  – Lightness Races in Orbit
  Mar 9 at 3:16
  
  

  
  
  
  

 | 
show 2 more comments

I am trying to get the deletion time out of a Recycle.Bin $I file. The returned timestamp is in local time (Pacific Daylight Time (-700)). The timestamp is correct but I want it in UTC. I am having difficulty in figuring this out. Reference:
https://4n6xplorer.com/forensics/once-upon-a-time-in-recycle-bin/

import os
import time
import datetime

filename = "$IU0OUS4.txt"
with open(filename, 'rb') as f:
 bindata = f.read()
f.close()

del_time = bindata[16:24]
print("binary output(bytes 16:23): " + str(del_time))

int_epoch_1601_ns = int.from_bytes(del_time, byteorder = 'little')
print("Epoch 1601 in nanoseconds: " + str(int_epoch_1601_ns))

int_epoch_1601_seconds = int((int_epoch_1601_ns * 100) / 1000000000)
print("Epoch 1601 in seconds: " + str(int_epoch_1601_seconds))

#fudge_factor - diff between epochs - 1/1/1601 and 1/1/1970 
fudge_factor = -11644516800

int_epoch_1970_seconds = fudge_factor + int_epoch_1601_seconds
print("Epoch 1970 in seconds: " + str(int_epoch_1970_seconds))

delete_timestamp = time.ctime(int_epoch_1970_seconds) # generate timestamp
print("File deleted: " + delete_timestamp)

OUTPUT

binary output(bytes 16:23): b'xe0zx1c1xee`xd4x01'
Epoch 1601 in nanoseconds: 131836865243020000
Epoch 1601 in seconds: 13183686524
Epoch 1970 in seconds: 1539169724
File deleted: Wed Oct 10 04:08:44 2018

python datetime

share|improve this question

edited Mar 13 at 20:24

Damonv2

asked Mar 7 at 18:17

Damonv2Damonv2

12

import os
import time
import datetime

filename = "$IU0OUS4.txt"
with open(filename, 'rb') as f:
 bindata = f.read()
f.close()

del_time = bindata[16:24]
print("binary output(bytes 16:23): " + str(del_time))

int_epoch_1601_ns = int.from_bytes(del_time, byteorder = 'little')
print("Epoch 1601 in nanoseconds: " + str(int_epoch_1601_ns))

int_epoch_1601_seconds = int((int_epoch_1601_ns * 100) / 1000000000)
print("Epoch 1601 in seconds: " + str(int_epoch_1601_seconds))

#fudge_factor - diff between epochs - 1/1/1601 and 1/1/1970 
fudge_factor = -11644516800

int_epoch_1970_seconds = fudge_factor + int_epoch_1601_seconds
print("Epoch 1970 in seconds: " + str(int_epoch_1970_seconds))

delete_timestamp = time.ctime(int_epoch_1970_seconds) # generate timestamp
print("File deleted: " + delete_timestamp)

binary output(bytes 16:23): b'xe0zx1c1xee`xd4x01'
Epoch 1601 in nanoseconds: 131836865243020000
Epoch 1601 in seconds: 13183686524
Epoch 1970 in seconds: 1539169724
File deleted: Wed Oct 10 04:08:44 2018

share|improve this question

edited Mar 13 at 20:24

Damonv2

asked Mar 7 at 18:17

Damonv2Damonv2

12

share|improve this question

edited Mar 13 at 20:24

Damonv2

asked Mar 7 at 18:17

Damonv2Damonv2

12

asked Mar 7 at 18:17

Damonv2Damonv2

12

asked Mar 7 at 18:17

Damonv2Damonv2

12