Source: Juni_2026_Exams/Advance_Forensics/notes/06-timeline-and-timestamps.md

🕐 Timeline & Timestamps Guide (DCode)

Why Timestamps Matter

Timestamps are the most important forensic evidence. They prove:

When the file was created
When it was modified
When it was accessed
When the malware ran
When the breach occurred

🎯 The 4 Timestamps (MACB)

Every file has 4 timestamps. Learn this pattern:

M = Modified (file content changed)
A = Accessed (file was read/opened)
C = Created (file born)
B = MFT Changed (metadata changed) or "Birth"

What Each Means

Letter	Name	Meaning	Example
M	Modified	Last time file was written to	Document edited
A	Accessed	Last time file was opened/read	Log file read
C	Created	File creation time	File first saved
B	MFT Changed	Metadata update (rare for normal files)	After antiforensics

🔢 Timestamp Formats

Format 1: Windows FILETIME (Most Common in Registry)

Format: Hexadecimal or decimal What it is: 100-nanosecond intervals since January 1, 1601 Example: 01D12345ABCDEF (hex) or 8609996334000000 (decimal)

Where found:

Registry hives (ShutdownTime, InstallDate)
MFT Explorer timestamps
File metadata

How to convert:

Copy hex value: 01D12345ABCDEF
Open DCode
Select: "Windows FILETIME"
Paste: 01D12345ABCDEF (without 0x)
Result: 2021-08-10 14:30:45 UTC

Format 2: Unix Epoch (Common in Logs)

Format: Decimal number What it is: Seconds since January 1, 1970 00:00:00 UTC Example: 1628610645

Where found:

Linux/Unix logs
Some Windows logs
Web server logs

How to convert:

Copy: 1628610645
Open DCode
Select: "Unix timestamp"
Paste: 1628610645
Result: 2021-08-10 14:30:45 UTC

Format 3: DOS Timestamp

Format: Hexadecimal (2 bytes for date, 2 bytes for time) What it is: Legacy format from older Windows Example: 5208 B30A

How to convert:

Copy: 5208B30A
Open DCode
Select: "DOS timestamp"
Result: 2021-08-10 14:30:45

Format 4: String Format (Human-Readable)

Format: Already readable Example: 2021-08-10 14:30:45 UTC

No conversion needed — already in readable form

🔄 Converting with DCode

Step-by-Step Conversion

Step 1: Launch DCode

Windows: C:\Program Files\AccessData\DCode\DCode.exe
Or: Search for DCode
Or: Use online version (if offline tool unavailable)

Step 2: Select Input Format

Menu on left side shows:
├── Unix Timestamp
├── Windows FILETIME
├── DOS Timestamp
├── Mac Timestamp
└── Other formats

Step 3: Paste Value

Copy registry value (e.g., 01D123456789ABCD)
Paste into DCode input field

Step 4: Read Output

DCode shows immediately:
├── UTC time: 2021-08-10 14:30:45 UTC
├── Local time: [converted to your timezone]
├── Timestamp: Decimal equivalent
└── Confidence: Whether conversion is valid

Example Conversions

Example 1: Registry ShutdownTime

Value (hex): 01D123456789ABCD

DCode:
├── Input format: Windows FILETIME
├── Paste: D123456789ABCD (remove 01)
├── Result: 2021-08-10 14:30:45 UTC
└── Local (CET): 2021-08-10 16:30:45 (UTC+2)

Example 2: Installation Date

Value (decimal): 1628610645

DCode:
├── Input format: Unix Timestamp
├── Paste: 1628610645
├── Result: 2021-08-10 14:30:45 UTC
└── Local (CET): 2021-08-10 16:30:45 (UTC+2)

🌍 UTC vs Local Time

The Difference

UTC:   Universal Coordinated Time (reference, no timezone)
LOCAL: Your computer's timezone (UTC + offset)

Example:
└─ Event occurs: 2021-08-10 12:30:00 UTC
   └─ Central European Time (CET = UTC+2)
   └─ Displays as: 2021-08-10 14:30:00 CEST

Which to Use in Answers?

In exam, answer with BOTH:
├─ UTC time (for international consistency)
└─ Local time (for context if relevant)

Example answer:
"Event occurred at 2021-08-10 12:30:00 UTC (14:30:00 CEST)"

Setting DCode Timezone

1. Open DCode
2. Settings → Timezone
3. Select your region (e.g., Europe/Berlin)
4. DCode shows LOCAL time in conversions

📊 Timeline Analysis

Creating a Timeline

Event 1: File created
├── Timestamp: 2021-08-01 10:00 UTC
├── Source: MFT Created time
└── Note: Malware file planted

Event 2: File modified
├── Timestamp: 2021-08-05 15:30 UTC
├── Source: MFT Modified time
└── Note: Configuration changed

Event 3: File accessed
├── Timestamp: 2021-08-10 14:30 UTC
├── Source: LNK file access
└── Note: User opened malware

Event 4: System shutdown
├── Timestamp: 2021-08-10 18:45 UTC
├── Source: Registry ShutdownTime
└── Note: System powered down

Timeline:
2021-08-01 10:00 ← Malware planted
2021-08-05 15:30 ← Configuration updated
2021-08-10 14:30 ← User accessed/executed
2021-08-10 18:45 ← System shutdown

⏱️ Timestamp Anomalies (Red Flags)

Red Flag 1: Created > Modified

Example:
├── Created:  2021-08-10 14:30
├── Modified: 2021-08-10 14:25 ← EARLIER than created!

Meaning: IMPOSSIBLE (file can't be modified before creation)
Reason: Likely antiforensics or timestamp manipulation

Red Flag 2: Suspiciously Old Date

Example:
├── Created:  1980-01-01 00:00 ← Impossible old date
├── Modified: 2021-08-10

Meaning: Timestamp spoofed/modified
Reason: Attacker tried to hide file creation time

Red Flag 3: Future Timestamp

Example:
├── Created:  2099-12-31 23:59 ← Future date!
├── Current:  2021-08-10

Meaning: Clock was wrong or timestamp set intentionally
Reason: Possible malware activity

Red Flag 4: Rapid Modification

Example:
├── Created:  2021-08-10 14:30:00
├── Modified: 2021-08-10 14:30:01 ← 1 second later!
├── Modified: 2021-08-10 14:30:02 ← 2 seconds later!

Meaning: Automated process or script
Reason: Likely malware or batch operation

🎯 Exam Questions Involving Timestamps

Q: "When was the malware installed?"

Answer: Use Created timestamp from MFT or Registry InstallDate
Format: [Date] [Time] UTC

Q: "When was it last executed?"

Answer: Use LNK access time or Registry UserAssist time
Format: [Date] [Time] UTC (with local timezone for context)

Q: "Create a timeline of user activity"

Answer: List all timestamps chronologically
├─ Created: Time 1
├─ Modified: Time 2
├─ Accessed: Time 3
└─ Explanation of what each means

Q: "Is there evidence of antiforensics?"

Answer: Check for timestamp anomalies
├─ Created > Modified: YES = Tampering
├─ Very old/future dates: YES = Spoofing
└─ Conclusion: Evidence suggests timestamp manipulation

⚠️ Common Timestamp Mistakes

Mistake 1: Using Wrong Format

❌ Wrong: Registry value 1628610645 is a hex value
✅ Right: It's decimal Unix timestamp, convert accordingly

Mistake 2: Forgetting UTC

❌ Wrong: "File created at 14:30" (which timezone?)
✅ Right: "File created at 14:30 UTC" or "14:30 UTC (16:30 CEST)"

Mistake 3: Confusing Timestamps

❌ Wrong: "File accessed date = creation date"
✅ Right: Accessed ≠ Created. They're different times.

Mistake 4: Not Converting

❌ Wrong: Answer with raw hex/timestamp value
✅ Right: Convert to readable date/time first

Mistake 5: Ignoring Anomalies

❌ Wrong: "Created: 2021-08-10, Modified: 2021-08-09" (ignore)
✅ Right: Note this is impossible, flag as tampering

📋 Timestamp Checklist

For every important file:

[ ] Created (C) - When was file first created? [use DCode]
[ ] Modified (M) - When was it last changed? [use DCode]
[ ] Accessed (A) - When was it last opened? [use DCode]
[ ] MFT Changed (B) - When was metadata changed? [use DCode]
[ ] Anomalies? - Is Created > Modified? (Impossible!)
[ ] Suspicions? - Very old or future dates?
[ ] Timezone - UTC or local? Be explicit!

🔗 Timestamp Sources

From Registry

SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate
SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

From MFT Explorer

Created, Modified, Accessed times for every file

From LNK Files

Access time of shortcut = User access time

From Event Logs

Various events with timestamps

💡 Pro Tips

Tip 1: Always Screenshot DCode Result

When converting timestamp:
1. Paste value into DCode
2. Get result
3. Screenshot the result
4. Paste in your answer (proof of conversion)

Tip 2: Create a Conversion Reference

Keep a list of common timestamps you encounter:
├─ 0 (Unix) = 1970-01-01 00:00 UTC
├─ 1628610645 (Unix) = 2021-08-10 14:30 UTC
└─ etc.

Tip 3: Note Timezone Consistently

Pick one timezone convention and use throughout:
├─ All UTC? (recommended)
├─ All local? (note timezone every time)
└─ Mix? (clearly label each)

🎓 Quick Reference Card - Print This

FILETIME Format: 100-nanosecond intervals since 1601
Unix Format: Seconds since 1970
DOS Format: Legacy 16-bit date/time

Conversion:
1. Identify format
2. Open DCode
3. Select format type
4. Paste value (remove 0x for hex)
5. Read result

Anomalies:
Created > Modified = SUSPICIOUS
Future date = SUSPICIOUS
Very old date = SUSPICIOUS

Always use: [Date] [Time] UTC in answers

📝 Exam Template

Question: Provide timeline of events

Method:
1. Extracted timestamps from:
   ├─ Registry (SOFTWARE, SYSTEM, NTUSER.DAT)
   ├─ MFT (file metadata)
   └─ LNK files (access times)

2. Converted all times with DCode:
   ├─ Format: Windows FILETIME / Unix
   └─ Timezone: UTC

Timeline:
┌─────────────────────────────────┐
│ 2021-08-01 10:00 UTC - File     │
│ 2021-08-05 15:30 UTC - Modified │
│ 2021-08-10 14:30 UTC - Accessed │
│ 2021-08-10 18:45 UTC - Shutdown │
└─────────────────────────────────┘

Answer: Clear chronological order of events

Last Updated: June 15, 2026