They are 32bit Unix timestamps.
Thanks again, but how did you know that these were 32bit Unix timestamps? there are other decode formats i can set the program to and it will still decode to a date. How did you know which format to trust?
> how did you know that these were 32bit Unix timestamps?
That comes in part from knowing the structure of the Event Log records.
Hows that?
I do know the structure of the event log records.
> Hows that?
>
> I do know the structure of the event log records.
Okay, then…it sounds like you just answered your own question! 😉
Here's some documentation from MS
http//
If you read it, you'll see that the timestamps are both 4-byte values and they meet the definition of "32bit Unix timestamps".
I guess maybe I'm missing something, then…you say that you know the structure and format of the event records, but you're asking "how did you know that these were 32bit Unix timestamps?". I mean, it's right there in the structure documentation.
I must be completely off-base here and completely misunderstanding what you're asking…sorry…
H
Its ok
Its ok
What does that mean?
I must be completely off-base here and completely misunderstanding what you're asking…sorry…
its ok
maybe he's accepting your apology lol
Maybe…but it might help more if he were to clear up some things…
I wrote a similar program, it decodes various formats, except the program is command line. You can download it at