DCode

DCode™ is a FREE forensic utility for converting data found on desktop and mobile devices into human-readable timestamps. It is the most comprehensive tool available for decoding timestamps and is a must-have utility for your tool box.

The software was designed to assist forensic examiners in identifying and decoding timestamp data during a forensic investigation. It will also allow the reverse process where timestamps can be encoded into a number of different formats and data types.

Encoding and Decoding Timestamp Data

## Encoding and Decoding Timestamp Data

DCode™ has support for 69 different timestamp formats from various operating systems and platforms. You can decode values in the form of Little-Endian Hexadecimal, Big-Endian Hexadecimal, 64-bit Integers, 32-bit Integers, Double-precision floating-point numbers and various text formats.

DCode™ also supports time zone translation and will show UTC (Zulu) times and a converted local time based on the selected time zone. If you select the “K” identifier in the timestamp pattern, DCode™ will also display the time zone designator.

## Time Zone Translation

When the Select Time Zone button is clicked, the following window is displayed showing a breakdown of all the parameters for each Time Zone. You can also select the No Adjustment button. This allows each timestamp to be decoded without applying any translation.

## Supported Timestamp Formats

DCode™ can convert the following timestamps into a number of different input and output formats such as Numeric (Int32, Int64, Double-precision floating-point), Hexadecimal (Little-Endian), Hexadecimal (Big-Endian) and Text.

- Apple Absolute Time (Seconds)

- Apple Absolute Time (Nanosecond)

- Apple HFS

- Apple HFS+

- Binary Coded Decimal (BCD) (2-digit Year)

- Binary Coded Decimal (BCD) Extended (4-digit Year)

- Binary Coded Decimal (BCD) Reverse Nibble

- Chromium Time (Microseconds)

- Chromium Time (Milliseconds)

- Chromium Time (Seconds)