dissect.util.ts#

Module Contents#

Classes#

UTC

tzinfo class for timezones that have a fixed-offset from UTC

Functions#

now

Return an aware datetime object of the current time in UTC.

unix_now

Return a Unix timestamp of the current time.

unix_now_ms

Return a Unix millisecond timestamp of the current time.

unix_now_us

Return a Unix microsecond timestamp of the current time.

unix_now_ns

Return a Unix nanosecond timestamp of the current time.

to_unix

Converts datetime objects into Unix timestamps.

to_unix_ms

Converts datetime objects into Unix millisecond timestamps.

to_unix_us

Converts datetime objects into Unix microsecond timestamps.

to_unix_ns

Converts datetime objects into Unix nanosecond timestamps.

from_unix

Converts Unix timestamps to aware datetime objects in UTC.

from_unix_ms

Converts Unix timestamps in milliseconds to aware datetime objects in UTC.

from_unix_us

Converts Unix timestamps in microseconds to aware datetime objects in UTC.

from_unix_ns

Converts Unix timestamps in nanoseconds to aware datetime objects in UTC.

xfstimestamp

Converts XFS timestamps to aware datetime objects in UTC.

wintimestamp

Converts Windows timestamps to aware datetime objects in UTC.

oatimestamp

Converts OLE Automation timestamps to aware datetime objects in UTC.

webkittimestamp

Converts WebKit timestamps to aware datetime objects in UTC.

cocoatimestamp

Converts Apple Cocoa Core Data timestamps to aware datetime objects in UTC.

uuid1timestamp

Converts UUID version 1 timestamps to aware datetime objects in UTC.

dostimestamp

Converts MS-DOS timestamps to naive datetime objects.

Attributes#

dissect.util.ts.now() datetime.datetime#

Return an aware datetime object of the current time in UTC.

dissect.util.ts.unix_now() int#

Return a Unix timestamp of the current time.

dissect.util.ts.unix_now_ms() int#

Return a Unix millisecond timestamp of the current time.

dissect.util.ts.unix_now_us() int#

Return a Unix microsecond timestamp of the current time.

dissect.util.ts.unix_now_ns() int#

Return a Unix nanosecond timestamp of the current time.

dissect.util.ts.to_unix(dt: datetime.datetime) int#

Converts datetime objects into Unix timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix timestamp from the passed datetime object.

dissect.util.ts.to_unix_ms(dt: datetime.datetime) int#

Converts datetime objects into Unix millisecond timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix millisecond timestamp from the passed datetime object.

dissect.util.ts.to_unix_us(dt: datetime.datetime) int#

Converts datetime objects into Unix microsecond timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix microsecond timestamp from the passed datetime object.

dissect.util.ts.to_unix_ns(dt: datetime.datetime) int#

Converts datetime objects into Unix nanosecond timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix nanosecond timestamp from the passed datetime object.

dissect.util.ts.from_unix(ts: float) datetime.datetime#

Converts Unix timestamps to aware datetime objects in UTC.

This is a convenience method.

Parameters:

ts – The Unix timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.from_unix_ms(ts: float) datetime.datetime#

Converts Unix timestamps in milliseconds to aware datetime objects in UTC.

Parameters:

ts – The Unix timestamp in milliseconds.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.from_unix_us(ts: float) datetime.datetime#

Converts Unix timestamps in microseconds to aware datetime objects in UTC.

Parameters:

ts – The Unix timestamp in microseconds.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.from_unix_ns(ts: float) datetime.datetime#

Converts Unix timestamps in nanoseconds to aware datetime objects in UTC.

Parameters:

ts – The Unix timestamp in nanoseconds.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.xfstimestamp(seconds: int, nano: int) datetime.datetime#

Converts XFS timestamps to aware datetime objects in UTC.

Parameters:
  • seconds – The XFS timestamp seconds component

  • nano – The XFS timestamp nano seconds component

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.ufstimestamp#
dissect.util.ts.wintimestamp(ts: int) datetime.datetime#

Converts Windows timestamps to aware datetime objects in UTC.

Parameters:

ts – The Windows timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.oatimestamp(ts: float) datetime.datetime#

Converts OLE Automation timestamps to aware datetime objects in UTC.

Parameters:

ts – The OLE Automation timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.webkittimestamp(ts: int) datetime.datetime#

Converts WebKit timestamps to aware datetime objects in UTC.

Parameters:

ts – The WebKit timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.cocoatimestamp(ts: int) datetime.datetime#

Converts Apple Cocoa Core Data timestamps to aware datetime objects in UTC.

Parameters:

ts – The Apple Cocoa Core Data timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.uuid1timestamp(ts: int) datetime.datetime#

Converts UUID version 1 timestamps to aware datetime objects in UTC.

UUID v1 timestamps have an epoch of 1582-10-15 00:00:00.

Parameters:

ts – The UUID version 1 timestamp

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.dostimestamp(ts: int, centiseconds: int = 0, swap: bool = False) datetime.datetime#

Converts MS-DOS timestamps to naive datetime objects.

MS-DOS timestamps are recorded in local time, so we leave it up to the caller to add optional timezone information.

According to http://www.vsft.com/hal/dostime.htm

Parameters:
  • timestap – MS-DOS timestamp

  • centisecond – Optional ExFAT centisecond offset. Yes centisecond…

  • swap – Optional swap flag if date and time bytes are swapped.

Returns:

Datetime object from the passed timestamp.

class dissect.util.ts.UTC(tz_dict: Dict[str, int])#

Bases: datetime.tzinfo

tzinfo class for timezones that have a fixed-offset from UTC

Parameters:

tz_dict – Dictionary of {"name": "timezone name", "offset": offset_from_UTC_in_minutes}

utcoffset(dt)#

datetime -> timedelta, positive for east of UTC, negative for west of UTC

tzname(dt)#

datetime -> string name of time zone.

dst(dt)#

datetime -> DST offset as timedelta, positive for east of UTC.

Return 0 if DST not in effect. utcoffset() must include the DST offset.