We are pleased to announce the release of Digital Detective’s DCode™ v5. This useful FREE application has been featured in numerous forensic books and papers over the years, and we have now had the opportunity to add some new features and bring it up to date.
The software was designed to assist forensic examiners in converting data found, when conducting analysis of desktop and mobile devices, into human-readable timestamps. It also allows the reverse process where timestamps can be encoded into a number of different formats.
Encoding and Decoding Timestamp Data
DCode™ v5 now features support for 60 different timestamp formats from various operating systems and platforms. You can decode values in the form of Little-Endian Hexadecimal, Big-Endian Hexadecimal, 64-bit Integers, 32-bit Integers, Double-precision floating-point numbers and various text formats.
DCode™ v5 also supports time zone conversion and will show UTC (Zulu) time and a converted time based on the selected time zone. If you select the “K” identifier in the timestamp pattern, DCode™ will also display the time zone designator.
Supported Timestamp Formats
DCode™ can convert the following timestamps into a number of different input and output formats such as Numeric (Int32, Int64, Double-precision floating-point), Hexadecimal (Little-Endian), Hexadecimal (Big-Endian) and Text.
- Apple Absolute Time
- Apple HFS
- Apple HFS+
- Binary Coded Decimal (BCD) (2-digit Year)
- Binary Coded Decimal (BCD) Extended (4-digit Year)
- Binary Coded Decimal (BCD) Reverse Nibble
- Google Chrome Timestamp
- GPS Time
- GSM Time
- Microsoft Ticks
- Motorola Timestamp
- Microsoft FAT MS-DOS (32-bit) Timestamp
- Microsoft FAT MS-DOS (40-bit) Timestamp
- Microsoft MS-DOS (32-bit) wFatDate, wFatTime Timestamp
- Nokia Series 30
- Nokia Series 40
- OLE Automation (64-bit Double)
- Seagate Date Code
- SYSTEMTIME Structure
- Unix Seconds
- Unix Milliseconds
- Unix Microseconds
- UUID (Guid) Timestamp
- Windows Filetime
- Windows Filetime [dwLow:dwHigh]
- Windows Filetime Mime Boundary [dwHigh.dwLow]
- Windows Filetime MSIE Cookie [dwLow,dwHigh]
Release Date: 2020-07-13 Build: 5.2.20195.4 File: DCode-x86-EN-5.2.20195.4.exe Length: 22.8 MB MD5: 90-b5-c3-a0-cd-bf-f2-d3-86-2a-2f-13-30-9d-50-35
Thanks for continuing to contribute to the forensic community. I’ve been a long time user of the prior version of DCode.
I just downloaded it and installed it on my Surface Pro running W10. It launches in a rather small window so the input fields are overlapping. It does not allow me to resize the window. Are others having this issue? I tried rebooting the computer but it did not correct the issue.
Just tested on another laptop and the window size is much better. The issue seems to be when you use zoom in the display settings. The screen on the Surface Pro is smaller, but higher resolution. The recommended zoom setting is 200%. On the larger laptop the screen resolution is less, and the recommended zoom setting is 125%.
If I reduce the zoom setting on the Surface Pro, then I can see the full window properly. But then everything is much smaller due to the high resolution.
Hi Jacques
I will release and update later today that should fix the issue you are seeing.
Please try v5.1 from the link above.
Regards
Craig
Thanks Craig. Worked like a charm.
Jacques
Thank you for making such a great tool available for free!