com.microsoft.office.plist - help with "Access Date"

Ah yes, "decode", the french version of DCode 😉

http//www.digital-detective.co.uk/freetools/decode.asp

I used DCode from Digital Detective to convert the date using the HFS+ 32 Bit Little Endian option.

Thanks ) , then it is
http//sandersonforensics.com/forum/content.php?131-A-brief-history-of-time-stamps

HFS Plus timestamps represent the time in seconds since midnight Jan 1, 1904.

The leading 00's obviously allow for some time in the future, the appended two bytes remain "a mistery", right?

Or maybe are "fractions of seconds"? ?

jaclaz

Hello,

I did some testing earlier this year for Office 2008 on Mac plist file. The timestamp was in HFS+ Little Endian, 32bit.

In this example the access date is listed as 00001c33 5ccdcd1c

Take 1c33 5ccd for your timestamp. I haven't figured out what the cd1c is.

Your date, 61BA82CA would be Tue, 30 August 2011 160345 UTC (using decode)

Hate to dig up an old post, but this was relevant in a case I'm working on. So, I couldn't quite figure out how MissMari got that time stamp. My date stamp is 3AACBFD5. Little Endian = D5BFAC3A, converted to decimal = 3586108474, HFS+ Time Stamp Converter = Sunday, August 20, 2017 91434 PM

https://www.epochconverter.com/mac

Thanks!!!