What kind of date stamp is this?

up vote
3
down vote

favorite

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

182

New contributor

add a commentÂ |Â

up vote
3
down vote

favorite

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

182

New contributor

add a commentÂ |Â

up vote
3
down vote

favorite

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

182

New contributor

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

asked Sep 7 at 4:23

Matt Hovey

182

New contributor

asked Sep 7 at 4:23

Matt Hovey

182

New contributor

asked Sep 7 at 4:23

Matt Hovey

182

asked Sep 7 at 4:23

Matt Hovey

182

New contributor

Matt Hovey is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
5
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

3216

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "489"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

Matt Hovey is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2freverseengineering.stackexchange.com%2fquestions%2f19280%2fwhat-kind-of-date-stamp-is-this%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
5
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

3216

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

up vote
5
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

3216

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

up vote
5
down vote

accepted

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

3216

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

3216

edited Sep 7 at 5:20

answered Sep 7 at 5:13

Abigail

3216

answered Sep 7 at 5:13

Abigail

3216

answered Sep 7 at 5:13

Abigail

3216

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

1

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

I also thought it would be a double, but expected it to be the Julian Day. Well done!
â€“Â 0xC0000022Lâ™¦
Sep 7 at 8:21

add a commentÂ |Â

Matt Hovey is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Matt Hovey is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Post as a guest

Name

Search This Blog

Iyfjky