Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20117

General Discussion: com.microsoft.office.plist - help with "Access Date"

$
0
0
MissMari wrote: Ah yes, "decode", the french version of DCode <img src="images/smiles/icon_wink.gif" alt="Wink" title="Wink" /> http://www.digital-detective.co.uk/freetools/decode.asp I used DCode from Digital Detective to convert the date using the HFS+ 32 Bit Little Endian option.Thanks <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" /> , then it is: http://sandersonforensics.com/forum/content.php?131-A-brief-history-of-time-stamps Quote:: HFS Plus timestamps represent the time in seconds since midnight Jan 1, 1904.The leading 00's obviously allow for some time in the future, the appended two bytes remain "a mistery", right? Or maybe are "fractions of seconds"? <img src="images/smiles/icon_question.gif" alt="Question" title="Question" /> jaclaz

Viewing all articles
Browse latest Browse all 20117

Trending Articles