Question 1

What is a Unix timestamp?

Accepted Answer

A Unix timestamp (epoch time) is the number of seconds elapsed since January 1, 1970 00:00:00 UTC. It provides a universal, timezone-independent way to represent dates and times. For example, 1704067200 represents January 1, 2024 00:00:00 UTC. Timestamps can be in seconds (10 digits) or milliseconds (13 digits).

Question 2

How does Windows FILETIME differ from Unix timestamps?

Accepted Answer

Windows FILETIME counts 100-nanosecond intervals since January 1, 1601 UTC, while Unix time counts seconds since January 1, 1970 UTC. To convert: Unix = (FILETIME - 116444736000000000) / 10000000. FILETIME appears in PE headers, Windows registry, and NTFS file systems, often as 64-bit hex values.

Question 3

Why are timestamps important in malware analysis?

Accepted Answer

PE header timestamps reveal when malware was compiled, helping track threat actor activity patterns and campaign timelines. Timestamps can also indicate sandbox detection (checking for anomalous system times) or timestomping (manipulating file times to evade forensics). Analysts correlate timestamps across samples to identify relationships.

Question 4

What is the Y2K38 problem with Unix timestamps?

Accepted Answer

Unix timestamps stored as 32-bit signed integers will overflow on January 19, 2038 at 03:14:07 UTC. This "Y2K38" bug affects legacy systems still using 32-bit time_t. Modern systems use 64-bit timestamps, which can represent dates until the year 292 billion. Check your systems for 32-bit timestamp dependencies before 2038.

Question 5

How do I convert timestamps with milliseconds or microseconds?

Accepted Answer

Timestamps with 13 digits are in milliseconds (divide by 1000 for seconds). 16-digit timestamps are microseconds (divide by 1000000). JavaScript uses milliseconds, while most Unix systems use seconds. This tool auto-detects the format based on digit count and provides accurate conversions.

Question 6

What timezone should I use for timestamp analysis?

Accepted Answer

Always work in UTC for consistent analysis, especially when correlating events across systems or geographic locations. Unix timestamps are inherently UTC. Convert to local time only for final reporting. This tool displays both UTC and your local timezone for convenience.

Unix Timestamp Converter

Current Time

Timestamp → Date

Quick Reference

Need Digital Forensics Expertise?

Frequently Asked Questions

Explore More Tools

Terraform Plan Explainer

HTTP Request Builder

CSV to JSON Converter

Excel to JSON Converter

YAML to JSON Converter

Diff Checker

ℹ️ Disclaimer