dissect.util.ts

Module Contents

Functions

now	Return an aware datetime object of the current time in UTC.
unix_now	Return a Unix timestamp of the current time.
unix_now_ms	Return a Unix millisecond timestamp of the current time.
unix_now_us	Return a Unix microsecond timestamp of the current time.
unix_now_ns	Return a Unix nanosecond timestamp of the current time.
to_unix	Converts datetime objects into Unix timestamps.
to_unix_ms	Converts datetime objects into Unix millisecond timestamps.
to_unix_us	Converts datetime objects into Unix microsecond timestamps.
to_unix_ns	Converts datetime objects into Unix nanosecond timestamps.
from_unix	Converts Unix timestamps to aware datetime objects in UTC.
from_unix_ms	Converts Unix timestamps in milliseconds to aware datetime objects in UTC.
from_unix_us	Converts Unix timestamps in microseconds to aware datetime objects in UTC.
from_unix_ns	Converts Unix timestamps in nanoseconds to aware datetime objects in UTC.
xfstimestamp	Converts XFS timestamps to aware datetime objects in UTC.
wintimestamp	Converts Windows FILETIME timestamps to aware datetime objects in UTC.
oatimestamp	Converts OLE Automation timestamps to aware datetime objects in UTC.
webkittimestamp	Converts WebKit timestamps to aware datetime objects in UTC.
cocoatimestamp	Converts Apple Cocoa Core Data timestamps to aware datetime objects in UTC.
uuid1timestamp	Converts UUID version 1 timestamps to aware datetime objects in UTC.
dostimestamp	Converts MS-DOS timestamps to naive datetime objects.

Attributes

ufstimestamp
DOS_EPOCH_YEAR

dissect.util.ts.now() → datetime.datetime

Return an aware datetime object of the current time in UTC.

dissect.util.ts.unix_now() → int

Return a Unix timestamp of the current time.

dissect.util.ts.unix_now_ms() → int

Return a Unix millisecond timestamp of the current time.

dissect.util.ts.unix_now_us() → int

Return a Unix microsecond timestamp of the current time.

dissect.util.ts.unix_now_ns() → int

Return a Unix nanosecond timestamp of the current time.

dissect.util.ts.to_unix(dt: datetime.datetime) → int

Converts datetime objects into Unix timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix timestamp from the passed datetime object.

dissect.util.ts.to_unix_ms(dt: datetime.datetime) → int

Converts datetime objects into Unix millisecond timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix millisecond timestamp from the passed datetime object.

dissect.util.ts.to_unix_us(dt: datetime.datetime) → int

Converts datetime objects into Unix microsecond timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix microsecond timestamp from the passed datetime object.

dissect.util.ts.to_unix_ns(dt: datetime.datetime) → int

Converts datetime objects into Unix nanosecond timestamps.

This is a convenience method.

Parameters:

dt – The datetime object.

Returns:

Unix nanosecond timestamp from the passed datetime object.

dissect.util.ts.from_unix(ts: float) → datetime.datetime

Converts Unix timestamps to aware datetime objects in UTC.

This is a convenience method.

Parameters:

ts – The Unix timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.from_unix_ms(ts: float) → datetime.datetime

Converts Unix timestamps in milliseconds to aware datetime objects in UTC.

Parameters:

ts – The Unix timestamp in milliseconds.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.from_unix_us(ts: float) → datetime.datetime

Converts Unix timestamps in microseconds to aware datetime objects in UTC.

Parameters:

ts – The Unix timestamp in microseconds.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.from_unix_ns(ts: float) → datetime.datetime

Converts Unix timestamps in nanoseconds to aware datetime objects in UTC.

Parameters:

ts – The Unix timestamp in nanoseconds.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.xfstimestamp(seconds: int, nano: int) → datetime.datetime

Converts XFS timestamps to aware datetime objects in UTC.

Parameters:

• seconds – The XFS timestamp seconds component

• nano – The XFS timestamp nano seconds component

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.ufstimestamp

dissect.util.ts.wintimestamp(ts: int | tuple[int, int]) → datetime.datetime

Converts Windows FILETIME timestamps to aware datetime objects in UTC.

Parameters:

ts – The Windows timestamp integer or a tuple of integers (dwLowDateTime, dwHighDateTime)

Returns:

Datetime object from the passed timestamp.

Resources:

• https://learn.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime

dissect.util.ts.oatimestamp(ts: float) → datetime.datetime

Converts OLE Automation timestamps to aware datetime objects in UTC.

Parameters:

ts – The OLE Automation timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.webkittimestamp(ts: int) → datetime.datetime

Converts WebKit timestamps to aware datetime objects in UTC.

Parameters:

ts – The WebKit timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.cocoatimestamp(ts: int) → datetime.datetime

Converts Apple Cocoa Core Data timestamps to aware datetime objects in UTC.

Parameters:

ts – The Apple Cocoa Core Data timestamp.

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.uuid1timestamp(ts: int) → datetime.datetime

Converts UUID version 1 timestamps to aware datetime objects in UTC.

UUID v1 timestamps have an epoch of 1582-10-15 00:00:00.

Parameters:

ts – The UUID version 1 timestamp

Returns:

Datetime object from the passed timestamp.

dissect.util.ts.DOS_EPOCH_YEAR = 1980

dissect.util.ts.dostimestamp(ts: int, centiseconds: int = 0, swap: bool = False) → datetime.datetime

Converts MS-DOS timestamps to naive datetime objects.

MS-DOS timestamps are recorded in local time, so we leave it up to the caller to add optional timezone information.

References

• https://web.archive.org/web/20180311003959/http://www.vsft.com/hal/dostime.htm

Parameters:

• ts – MS-DOS timestamp

• centiseconds – Optional ExFAT centisecond offset. Yes centisecond…

• swap – Optional swap flag if date and time bytes are swapped.

Returns:

Datetime object from the passed timestamp.