REFERENCES.md

GPS Ref:

• http://www.leapsecond.com/java/gpsclock.htm

Leap Seconds:

• https://www.nist.gov/pml/time-and-frequency-division/leap-seconds-faqs
• http://hpiers.obspm.fr/eop-pc/index.php?index=TAI-UTC_tab&lang=en

Microsoft DateTime:

• https://docs.microsoft.com/en-us/dotnet/api/system.datetime?view=netframework-4.8

Microsoft Time:

• https://docs.microsoft.com/en-ca/windows/win32/sysinfo/time

Microsoft 1904 Timestamp:

• https://docs.microsoft.com/en-us/office/troubleshoot/excel/1900-and-1904-date-system

Microsoft OLE Automation Date (OADate):

• https://docs.microsoft.com/en-us/dotnet/api/system.datetime.tooadate?view=netframework-4.8

MSDOS wFatDate wFatTime DosDate:

• https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime

Microsoft FILETIME:

• https://support.microsoft.com/en-ca/help/188768/info-working-with-the-filetime-structure

Microsoft Active Directory/LDAP Timestamp:

• https://docs.microsoft.com/en-us/windows/win32/adschema/a-lastlogontimestamp

bplist timestamp / Mac Absolute / iOS / Cocoa

• https://developer.apple.com/documentation/corefoundation/cfabsolutetime
• https://developer.apple.com/documentation/foundation/nsdate

GSM Timestamps:

• https://en.wikipedia.org/wiki/GSM_03.40
• http://seven-bit-forensics.blogspot.com/2014/02/decoding-gsmsms-timestamps.html

Symantec AV Timestamp:

• https://knowledge.broadcom.com/external/article/151245/interpreting-endpoint-protection-av-log.html

VMWare Snapshot timestamp:

• https://stuffphilwrites.com/2013/03/vmware-snapshot-forensics/

TikTok and Twitter Timestamps:

• https://dfir.blog/tinkering-with-tiktok-timestamps/

Discord Timestamps:

• https://discord.com/developers/docs/reference#snowflakes
• Discord epoch is 1-1-2015 or 1420070400000

KSUID Timestamp value:

• https://github.com/segmentio/ksuid
• https://github.com/obsidianforensics/unfurl

Mastodon Social value:

• https://github.com/tootsuite/mastodon

Metasploit Payload UUID format:

• https://github.com/rapid7/metasploit-framework/wiki/Payload-UUID
• https://github.com/DidierStevens/Beta/blob/master/metatool.py

DHCPv6 DUID:

• https://tools.ietf.org/html/rfc3315#page-19

Microsoft .NET DateTime Struct (not .NET Framework)

• https://docs.microsoft.com/en-us/dotnet/api/system.datetime?view=net-6.0

GMail Boundary Timestamp

• https://www.metaspike.com/gmail-mime-boundary-delimiter-timestamps/

GMail Message ID Timestamp

• https://www.metaspike.com/dates-gmail-message-id-thread-id-timestamps/

Nokia Timestamp

• http://www.doubleblak.com/m/blogPosts.php?id=7#nokia

Nokia S40 Timestamp

• https://sqliteforensictoolkit.com/a-brief-history-of-time-stamps/

Bitwise Decimal Timestamp

• https://stackoverflow.com/questions/19185106/unknown-timestamp-reference-date/19553622#19553622
• Source of TS unknown, but since it's seemingly rare, it may be useful

BitDate

• https://sqliteforensictoolkit.com/a-brief-history-of-time-stamps/

Apple Biome data

• https://blog.d204n6.com/2022/09/ios-16-now-you-c-it-now-you-dont.html

S32 encoding and decoding - BlueSky Social Network

• https://github.com/bluesky-social/atproto/blob/main/packages/common-web/src/tid.ts
• https://github.com/bluesky-social/atproto/blob/main/packages/common-web/src/util.ts

Apache Cookie values

• https://github.com/apache/httpd/blob/trunk/modules/metadata/mod_usertrack.c#L99

LEB128 hex value (thanks to Justin Lazenby for identifying this one!)

• https://en.wikipedia.org/wiki/LEB128

Julian hex values

• https://stackoverflow.com/questions/56067745/hex-numbers-that-translate-into-date-and-time-stamps

Julian decimal values

• https://github.com/seanredmond/juliandate/

Semi-Octet value

• https://doubleblak.com/blogPost.php?k=timestamps#semioctet