What is a Windows FILETIME timestamp?

A Windows FILETIME is a 64-bit value counting 100-nanosecond intervals since 1601-01-01 00:00:00 UTC. It appears in NTFS $STANDARD_INFORMATION timestamps, registry key LastWrite times, EVTX event records, and Active Directory/LDAP timestamp attributes.

How do I convert a Unix timestamp to a readable date?

Unix time counts seconds (or milliseconds) since 1970-01-01 00:00:00 UTC. Enter the value in the Unix Epoch field and every other format, including ISO 8601 UTC and local time, updates instantly.

What is the difference between Windows FILETIME and .NET Ticks?

Both count 100-nanosecond intervals, but from different epochs: FILETIME starts at 1601-01-01, while .NET's DateTime.Ticks starts at 0001-01-01. The same instant produces very different-looking numbers in each, which is a common source of forensic analysis errors.

How is a Chrome or Edge history timestamp converted?

Chromium-based browsers (Chrome, Edge, Brave) store visit timestamps as microseconds since 1601-01-01 00:00:00 UTC in the History and Cookies SQLite databases. This is often called a WebKit timestamp.

What is an Excel serial date and how does it relate to OLE Automation Date?

An Excel serial date and an OLE Automation Date are the same representation for modern dates: days (with a fractional part for time of day) since 1899-12-30. This is the raw number behind any date-formatted Excel cell.

What is GPS time and why does it differ from UTC?

GPS time counts seconds since 1980-01-06 00:00:00 UTC and does not apply leap seconds the way UTC does, so it currently runs 18 seconds ahead of UTC (as of the last leap second on 2016-12-31). This matters when correlating GNSS-device or vehicle telemetry timestamps with other evidence.

Can I convert a list of timestamps at once?

Yes. The Batch view accepts a pasted list (one value per line), converts every line against a chosen format or a best-effort auto-detect, and flags rows that are ambiguous or unparseable. The Direct view also has a bulk mode for converting many values between one specific source and target format.

How accurate are the timestamp conversions?

Every epoch offset used in this tool (FILETIME, WebKit, Mac Absolute, HFS+, OLE Automation, .NET Ticks, GPS, Julian Date) was independently verified against calendar arithmetic and well-established public constants before release, not just assumed correct.

Forensic Timestamp Converter

Convert between forensic timestamp formats for timeline analysis. Edit any field, every other format updates instantly.

Currently showing

—

Unix Epoch (seconds)

Seconds since 1970-01-01 00:00:00 UTC. Used in Linux/macOS system logs, EXIF metadata, most REST APIs.

Unix Epoch (milliseconds)

Milliseconds since the Unix epoch. Used in JavaScript, Chrome DevTools, and most JSON-based application logs.

Windows FILETIME (decimal)

100-nanosecond intervals since 1601-01-01 00:00:00 UTC. Found in NTFS $STANDARD_INFORMATION, registry key LastWrite time, EVTX records, Active Directory/LDAP timestamp attributes.

ISO 8601 (UTC)

Accepts "YYYY-MM-DD HH:mm:ss" or full ISO 8601. Treated as UTC if no offset is given. Best format for timeline reports.

ISO 8601 (Local)

Same instant, shown and parsed using this browser's local timezone. Useful for correlating with a suspect's stated timezone.

Show 11 more formats Windows extras · Apple · Excel · Julian · GPS · RFC 2822

More Unix

Unix Epoch (nanoseconds)

Nanoseconds since the Unix epoch. Seen in high-resolution Linux audit logs, eBPF/Sysdig traces, and some structured JSON logging pipelines.

More Windows

Windows FILETIME (hex)

Same value as above, shown as the 8-byte hex value commonly seen when parsing raw MFT/registry data with a hex editor.

Windows / .NET Ticks

100-nanosecond intervals since 0001-01-01 00:00:00 UTC. This is System.DateTime.Ticks in .NET/PowerShell — a different epoch than FILETIME above, easy to mix up.

DOS Date/Time (32-bit)

16-bit packed date + 16-bit packed time, 2-second resolution, valid 1980–2107. Found in FAT filesystem directory entries and ZIP archive local file headers. Stores no timezone; historically interpreted as local time on the originating system.

Apple

Chrome / WebKit

Microseconds since 1601-01-01 00:00:00 UTC. Used in Chrome/Edge/Brave History and Cookies SQLite databases (visits.visit_time, last_visit_time).

Mac Absolute Time

Seconds since 2001-01-01 00:00:00 UTC. Used in macOS Cocoa/Core Data (CFAbsoluteTime, NSDate) and many plist timestamp values.

HFS+ / Mac OS Classic

Seconds since 1904-01-01 00:00:00 UTC. Legacy Macintosh filesystem timestamp (local time under classic HFS, UTC under HFS+).

Office / Spreadsheet

OLE Automation Date / Excel Serial Date

Days (with fractional day for time-of-day) since 1899-12-30. This is exactly what a date-formatted Excel cell shows as a raw number, and is also used in Microsoft Office/OLE-COM documents, VBA DATE values, and some registry DATE-typed values.

Legacy / Scientific

Julian Date (astronomical)

Days since noon UTC, 4713 BC (proleptic Julian calendar). Used in astronomy, some satellite/imagery metadata, and legacy mainframe systems.

Navigation

GPS Time

Seconds since 1980-01-06 00:00:00 UTC. GPS time does not apply leap seconds, so it currently runs 18 seconds ahead of UTC (the offset as of the last leap second, 2016-12-31; it will change if a new one is ever scheduled). Relevant to vehicle, drone, and GNSS-device forensics.

Web / Email

RFC 2822 (email Date header)

Standard format for the Date header in email (RFC 5322) and HTTP. What you see when you open a message's raw source / full headers.

Batch Conversion

Paste a list of timestamps (one per line) from a log export and convert them all at once. Pick the source format if you know it; use auto-detect only when you don't — it's a best-effort magnitude guess, not certain, and ambiguous rows are flagged for manual verification.

INPUT FORMAT