IE 9+ Tracking Lists

[guinness]

I found the other day in the Windows Registry a 7 digit number which is meant to be a date apparently, but can't figure out how to convert to a standard date format or what this format is, I know its not a Unix TimeStamp. I was wondering does anyone know of any documentation on MSDN that could explain a little further this date format? I tried searching but to no avail. Thanks.

Example:
Dec: 3596946
Hex: 36e292

Good example can be found if using Internet Explorer 9 with a tpl file:

"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Safety\PrivacIE\Lists\" & UNIQUE KEY & "\LastUpdateTime"

[I am Baas]

Check this link out http://www.epochconverter.com/

[guinness]

It's not epoch, but thanks for the link.

[I am Baas]

Well, the only other similar format that I know of is ctime. Have you tried that one?

[SYSTEM]

It doesn't seem to be any of the date formats supported by http://www.silisoftware.com/tools/date.php. When I set it to interpret the number as FILETIME, it returned a sensible date (April 22, 2009), but other fields had very odd values (e.g. Microsoft timestamp -109205), so I think the number is not FILETIME either.

[guinness]

Just tried and it reports Feb 11 1970. Thanks though.

[guinness]

It doesn't seem to be any of the date formats supported by http://www.silisoftware.com/tools/date.php. When I set it to interpret the number as FILETIME, it returned a sensible date (April 22, 2009), but other fields had very odd values (e.g. Microsoft timestamp -109205), so I think the number is not FILETIME either.

Strange.

For example now it's Hex: 372854 Dec: 3614804 and Fanboy's Adblock List was update 11th May 2013. So the date should be between then and now.

[I am Baas]

Hex 372854 = Dec 3614804
Hex 36e292 = Dec 3596946

Subtraction of the Hex / Dec numbers gives:

Hex 45c2 = Dec 17858

This, I believe, represents the number of hours passed between those 2 dates

17858 hours = 744 days and 2 hours

Remember this post?

Still trying to figure out the base year for the hex time stamps in the registry.

[SYSTEM]

Hex 372854 = Dec 3614804
Hex 36e292 = Dec 3596946

Subtraction of the Hex / Dec numbers gives:

Hex 45c2 = Dec 17858

This, I believe, represents the number of hours passed between those 2 dates

17858 hours = 744 days and 2 hours

Remember this post?

Still trying to figure out the base year for the hex time stamps in the registry.

Thanks. I continued your analysis: 3 614 804 hours is approximately 412 years and 136 days. That means that the base year is either 1600 or 1601. I think bugmenot2's opinion at http://www.autoitscript.com/forum/topic ... ?p=1025857 is right...

[I am Baas]

Thanks, SYSTEM.

http://en.wikipedia.org/wiki/Epoch_(reference_date)

http://en.wikipedia.org/wiki/Epoch_(ref ... _computing

[guinness]

Remember this post?

Course I do, I thought it was weird (scary) that 2 years had already passed. In hindsight I should have referenced this link.

I will digest both your suggestions and try to come up with a solution.

Edit: Actually those two dates are just examples and shouldn't be subtracted. The first value I provided was from 2 years ago, so I decided to provide a more up to date example.

All I have is the hex and decimal value to go by.

[SYSTEM]

Edit: Actually those two dates are just examples and shouldn't be subtracted. The first value I provided was from 2 years ago, so I decided to provide a more up to date example.

What? Subtraction was exactly the right way to solve the date format. It told us that the counter had advanced 17 858 units in a bit over two years, i.e. that the unit is one hour.

[guinness]

OK SYSTEM.