DCode™

We are pleased to announce the release of Digital Detective’s DCode™ v5. This useful FREE application has been featured in numerous forensic books and papers over the years, and we have now had the opportunity to add some new features and bring it up to date.

The software was designed to assist forensic examiners in converting data found, when conducting analysis of desktop and mobile devices, into human-readable timestamps. It also allows the reverse process where timestamps can be encoded into a number of different formats.

Encoding and Decoding Timestamp Data

DCode™ v5 now features support for 60 different timestamp formats from various operating systems and platforms. You can decode values in the form of Little-Endian Hexadecimal, Big-Endian Hexadecimal, 64-bit Integers, 32-bit Integers, Double-precision floating-point numbers and various text formats.

Figure 1. Encoding a date/time value into Little-Endian Hexadecimal format

Figure 2. Decoding a Windows Filetime from Little-Endian Hexadecimal format

DCode™ v5 also supports time zone conversion and will show UTC (Zulu) time and a converted time based on the selected time zone. If you select the “K” identifier in the timestamp pattern, DCode™ will also display the time zone designator.

Supported Timestamp Formats

DCode™ can convert the following timestamps into a number of different input and output formats such as Numeric (Int32, Int64, Double-precision floating-point), Hexadecimal (Little-Endian), Hexadecimal (Big-Endian) and Text.

• Apple Absolute Time
• Apple HFS
• Apple HFS+
• Binary Coded Decimal (BCD) (2-digit Year)
• Binary Coded Decimal (BCD) Extended (4-digit Year)
• Binary Coded Decimal (BCD) Reverse Nibble
• Google Chrome Timestamp
• GPS Time
• GSM Time
• Microsoft Ticks
• Motorola Timestamp
• Microsoft FAT MS-DOS (32-bit) Timestamp
• Microsoft FAT MS-DOS (40-bit) Timestamp
• Microsoft MS-DOS (32-bit) wFatDate, wFatTime Timestamp
• Nokia Series 30
• Nokia Series 40
• OLE Automation (64-bit Double)
• SYSTEMTIME Structure
• Unix Seconds
• Unix Milliseconds
• Unix Microseconds
• UUID (Guid) Timestamp
• Windows Filetime
• Windows Filetime [dwLow:dwHigh]
• Windows Filetime Mime Boundary [dwHigh.dwLow]
• Windows Filetime MSIE Cookie [dwLow,dwHigh]

Release Date: 2020-05-11
Build: 5.1.20132.42
File: DCode-x86-EN-5.1.20132.42.exe   Length: 26.5 MB
MD5:  d3-48-5f-16-a4-3f-9d-5d-20-20-09-2a-54-ee-d4-18