IE 9+ Tracking Lists

Any other tech-related topics
Post Reply
Message
Author
User avatar
guinness
Posts: 4118
Joined: Mon Aug 27, 2007 2:00 am
Contact:

IE 9+ Tracking Lists

#1 Post by guinness »

I found the other day in the Windows Registry a 7 digit number which is meant to be a date apparently, but can't figure out how to convert to a standard date format or what this format is, I know its not a Unix TimeStamp. I was wondering does anyone know of any documentation on MSDN that could explain a little further this date format? I tried searching but to no avail. Thanks.

Example:
Dec: 3596946
Hex: 36e292

Good example can be found if using Internet Explorer 9 with a tpl file:
"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Safety\PrivacIE\Lists\" & UNIQUE KEY & "\LastUpdateTime"

User avatar
I am Baas
Posts: 4150
Joined: Thu Aug 07, 2008 4:51 am

Re: IE 9+ Tracking Lists

#2 Post by I am Baas »

Check this link out http://www.epochconverter.com/

User avatar
guinness
Posts: 4118
Joined: Mon Aug 27, 2007 2:00 am
Contact:

Re: IE 9+ Tracking Lists

#3 Post by guinness »

It's not epoch, but thanks for the link.

User avatar
I am Baas
Posts: 4150
Joined: Thu Aug 07, 2008 4:51 am

Re: IE 9+ Tracking Lists

#4 Post by I am Baas »

Well, the only other similar format that I know of is ctime. Have you tried that one?

User avatar
SYSTEM
Posts: 2045
Joined: Sat Jul 31, 2010 1:19 am
Location: Helsinki, Finland

Re: IE 9+ Tracking Lists

#5 Post by SYSTEM »

It doesn't seem to be any of the date formats supported by http://www.silisoftware.com/tools/date.php. When I set it to interpret the number as FILETIME, it returned a sensible date (April 22, 2009), but other fields had very odd values (e.g. Microsoft timestamp -109205), so I think the number is not FILETIME either.
My YouTube channel | Release date of my 13th playlist: August 24, 2020

User avatar
guinness
Posts: 4118
Joined: Mon Aug 27, 2007 2:00 am
Contact:

Re: IE 9+ Tracking Lists

#6 Post by guinness »

Just tried and it reports Feb 11 1970. Thanks though.

User avatar
guinness
Posts: 4118
Joined: Mon Aug 27, 2007 2:00 am
Contact:

Re: IE 9+ Tracking Lists

#7 Post by guinness »

SYSTEM wrote:It doesn't seem to be any of the date formats supported by http://www.silisoftware.com/tools/date.php. When I set it to interpret the number as FILETIME, it returned a sensible date (April 22, 2009), but other fields had very odd values (e.g. Microsoft timestamp -109205), so I think the number is not FILETIME either.
Strange.

For example now it's Hex: 372854 Dec: 3614804 and Fanboy's Adblock List was update 11th May 2013. So the date should be between then and now.

User avatar
I am Baas
Posts: 4150
Joined: Thu Aug 07, 2008 4:51 am

Re: IE 9+ Tracking Lists

#8 Post by I am Baas »

Hex 372854 = Dec 3614804
Hex 36e292 = Dec 3596946

Subtraction of the Hex / Dec numbers gives:

Hex 45c2 = Dec 17858

This, I believe, represents the number of hours passed between those 2 dates

17858 hours = 744 days and 2 hours

Remember this post?

Still trying to figure out the base year for the hex time stamps in the registry.

User avatar
SYSTEM
Posts: 2045
Joined: Sat Jul 31, 2010 1:19 am
Location: Helsinki, Finland

Re: IE 9+ Tracking Lists

#9 Post by SYSTEM »

I am Baas wrote:Hex 372854 = Dec 3614804
Hex 36e292 = Dec 3596946

Subtraction of the Hex / Dec numbers gives:

Hex 45c2 = Dec 17858

This, I believe, represents the number of hours passed between those 2 dates

17858 hours = 744 days and 2 hours

Remember this post?

Still trying to figure out the base year for the hex time stamps in the registry.
Thanks. I continued your analysis: 3 614 804 hours is approximately 412 years and 136 days. That means that the base year is either 1600 or 1601. I think bugmenot2's opinion at http://www.autoitscript.com/forum/topic ... ?p=1025857 is right...
My YouTube channel | Release date of my 13th playlist: August 24, 2020


User avatar
guinness
Posts: 4118
Joined: Mon Aug 27, 2007 2:00 am
Contact:

Re: IE 9+ Tracking Lists

#11 Post by guinness »

I am Baas wrote:Remember this post?
Course I do, I thought it was weird (scary) that 2 years had already passed. In hindsight I should have referenced this link.

I will digest both your suggestions and try to come up with a solution.

Edit: Actually those two dates are just examples and shouldn't be subtracted. The first value I provided was from 2 years ago, so I decided to provide a more up to date example.

All I have is the hex and decimal value to go by.

User avatar
SYSTEM
Posts: 2045
Joined: Sat Jul 31, 2010 1:19 am
Location: Helsinki, Finland

Re: IE 9+ Tracking Lists

#12 Post by SYSTEM »

guinness wrote:Edit: Actually those two dates are just examples and shouldn't be subtracted. The first value I provided was from 2 years ago, so I decided to provide a more up to date example.
What? Subtraction was exactly the right way to solve the date format. It told us that the counter had advanced 17 858 units in a bit over two years, i.e. that the unit is one hour.
My YouTube channel | Release date of my 13th playlist: August 24, 2020

User avatar
guinness
Posts: 4118
Joined: Mon Aug 27, 2007 2:00 am
Contact:

Re: IE 9+ Tracking Lists

#13 Post by guinness »

OK SYSTEM.

Post Reply