Tuesday, August 25, 2009

Decoding the DateCreated and DateLastConnected SSID values From Vista/Win 7

This information was provided to me by Longshot (Just passing this great information along).

Decoding the DateCreated and DateLastConnected registry values from the registry keys

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}

In Vista and Windows 7

The DateCreated and DateLastConnected are binary values that can be broken up into 4 byte parts, with 1 part left over. Each 4 byte part corresponds to a value of a date. The order of the values are as follows:

Year
Month
Weekday
Day
Hour
Minutes
Seconds

Each of these 4 byte parts is in little endian. Using the following data that was unpacked from binary and converted to hex we get the following translation:

d9070200020018001700140025000001

d907 0200 0200 1800 1700 1400 2500 0001


Year = h4 = d907 = 07d9 = 2009

Month = h4 = 0200 = 0002 = Month {Jan = 1, Feb = 2, etc....}

Weekday = h4 = 0200 = 0020 = Weekday {Sunday = 0, Monday = 1, etc...}

date = h4 = 1800 = 0018 = 24

hour = h4 = 1700 = 0017 = 23

minutes = h4 = 1400 = 0014 = 20

Seconds = h4 = 2500 = 0025 = 37

The Month and Weekday fields have to be converted to their proper Month and weekday name.

which would yield the following:

Date First Connected: Tuesday, 24 February 2009 23:20:37


Here is the perl code to do the above, I only include the $data as a place holder that would need to get data fed to it:


use strict;

# This is the binary data that would be read from the registry file
my $data = "";

my %month_type = (1 => "January",
2 => "February",
3 => "March",
4 => "April",
5 => "May",
6 => "June",
7 => "July",
8 => "August",
9 => "September",
10 => "October",
11 => "November",
12 => "December");

my %dayofweek_type = (0 => "Sunday",
1 => "Monday",
2 => "Tuesday",
3 => "Wednesday",
4 => "Thursday",
5 => "Friday",
6 => "Saturday");


my ($year, $month, $weekday, $date, $hour, $minute, $second ) = unpack("h4 h4 h4 h4 h4 h4 h4", $data);

#This part converts the year
my $finalyear= hex(reverse $year);

#Now we convert the month
my $monthnumber=hex(reverse $month);
my $finalmonth = $month_type{$monthnumber};

#Now we convert the weekday
my $weekdaynumber=hex(reverse $weekday);
my $finalweekday = $dayofweek_type{$weekdaynumber};

# This converts the date
my $finaldate=hex(reverse $date);

#This converts the hour
my $finalhour=hex(reverse $hour);

#This converts the minute
my $finalminute=hex(reverse $minute);
my $howlongisfinalminute=length($finalminute);
if ($howlongisfinalminute == 1){
$finalminute="0$finalminute";
}
if ($finalminute eq "0"){
$finalminute='00';
}

#This converts the second
my $finalsecond=hex(reverse $second);
my $howlongisfinalsecond=length($finalsecond);
if ($howlongisfinalsecond == 1){
my $finalsecond="0$finalsecond";
}
if ($finalsecond eq "0"){
$finalsecond='00';
}

my $ssidtimestamp= "$finalweekday, $finaldate $finalmonth $finalyear $finalhour:$finalminute:$finalsecond";
if ($n =~ /Created/){
$finaln="Date First Connected:";
} else {
$finaln="Date Last Connected:";
}

print "$finaln $ssidtimestamp\n";

36 comments:

H. Carvey said...

Here's the code I use in the RegRipper plugin I wrote:

sub parseDate128 {
my $date = $_[0];
my @months = ("Jan","Feb","Mar","Apr","May","Jun","Jul",
"Aug","Sep","Oct","Nov","Dec");
my @days = ("Sun","Mon","Tue","Wed","Thu","Fri","Sat");
my ($yr,$mon,$dow,$dom,$hr,$min,$sec,$ms) = unpack("v*",$date);
$hr = "0".$hr if ($hr < 10);
$min = "0".$min if ($min < 10);
$sec = "0".$sec if ($sec < 10);
my $str = $days[$dow]." ".$months[$mon - 1]." ".$dom." ".$hr.":".$min.":".$sec." ".$yr;
return $str;
}

Andrew said...

Thanks folks, nice!

Anonymous said...

There is a tool out there that does this as well. It does a few others from what I have seen.

http://www.live-forensics.com/dl/DateDecoder.zip

Unknown said...

The last 4 bytes represent thousandths of a second. Range 0 to 3e7h or 0 to 999 decimal.

Unknown said...

DateDecoder.exe by the way does not handle the last 4 bytes correctly. DateDecoder.exe is the program in DateDecoder.zip mentioned above.

Unknown said...

A great post with on the topic as to how one can decode the that SSID values, using Windows 7 or Vista. Great piece of infomration shared well done....

Discount Steel Buildings

Vasily Kolobkov said...

Just in case - that date time structure is called SYSTEMTIME. It's one of the datetime representations (along with FILETIME) you can come across while parsing registry.

John said...

Very good blogging,
Utah SEO Adaptivity Pro premier seo services provider based in Utah.

Web Application Development said...

What a constructive blog! Much more people should do the same! Thank you very much.

jhon said...

Just would like to know does SSID stands for Session ID or some thing else.... ?

Hair Transplant Islamabad

Unknown said...

SSID is
service set identifier

mad men season 4 dvd australia said...

I am not very good at math. so I often type the wrong nummber.

Free SMS said...

SSID values, haven't they got any relationship with WIFI setting or similar... ???

alistair1 said...

This helped with my
computer forensics work. I was stuck.

f4v to youtube said...

Some say it will be hotlink acreage as accomplished website page will be abounding of links (ads) so may be Search Engines won’t like it.

pay per head said...

Hey, there's a great deal of helpful information above!

hermes so black birkin said...

Thanks for sharing the nice pictures. You have done a great work. Every homeowner can benefit from property management services.

SIFS INDIA said...

THANK YOU!! FOR THIS BLOG!!!
SIFS INDIA
2443, Basement,
Hudson Lane,
Kingsway Camp,
Delhi - 110009
Email: education@sifsindia.com

Website: www.sifs.in

friv 2 online said...

i think i need it. Thanks for update information. Love it :) Keep on posting!.
---
Signature:
i like play games friv 2 | friv2 | friv

clickjogos said...

There is a tool out there that does this as well.
----
play game click jogos online free | jogos click | clickjogos

Unknown said...

Thanks for sharing this quality information with us. I really enjoyed reading.

Signature:
descarga facebook
descargar facebook gratis
descargar facebook plus
descargar facebook

Unknown said...

I was working and suddenly I visits your site frequently and recommended it to me to read also. The writing style is superior and the content is relevant. Thanks for the insight you provide the readers!
Signature:
juegos de un show mas
un show mas
juego de un show mas
juego un show mas

Unknown said...

I was working and suddenly I visits your site frequently and recommended it to me to read also. The writing style is superior and the content is relevant. Thanks for the insight you provide the readers!
Signature:
download free descargar whatsapp gratis
baixar whatsapp gratis
descargar whatsapp
baixar whatsapp

juegoskizi said...

Thanks for sharing!
----
play game juegos kizi online and play game jogos do friv

Unknown said...

kursi tamu minimalis cocok untuk di taruh di rumah yang memiliki ruang tamu dengan ukuran Sempit dan Kecil bukan berarti anda sudah tidak bisa berinspirasi untuk mendesain ruang tamu rumah anda. mendesain ruang kursi tamu dirumah bisa dibilang gampang-gampang susah tergantung dengan keinginan kita, jika mungkin sedang memiliki Inspirasi untuk pilihan meja kursi tamu tentunya kami siap membantu anda. ada juga Set kursi meja makan luxury italian adalah model terbaru dari koleksi furniture jepara untuk kitchen room italian style, profuk furniture kursi makan ini memberikan kemewahan pada setiap detail interior rumah anda.furniture yang kami tawarkan merupakan produk terbaru dan desain custom, desain custom kami prioritaskan , karena desain custom untuk furniture yang kami jual merupakan produk yang belum pernah ada sebelumnya. untuk ruang kamar ada Set tempat tidur mewah dengan desain yang mewah dan elegan adalah Idaman bagi semua Orang untuk memilikinya ada juga bisa memiliki kamar set klasik mewah ini. Tempat tidur klasik ini adalah produk mebel jepara pilihan yang langsung dibuat oleh pengrajin mebel asal kota jepara yang sudah berpengalaman sehingga hasil kerja dan detail yang rapi dan maksimal. Set tempat tidur ini sangat cocok diterapkan di ruang kamar tidur yang memiliki ukuran yang besar serta interior ke arah eropa style. lihat produk furniture.

Unknown said...

I am pretty much pleased with your good work.You put really very helpful information. Keep it up. Keep blogging. Looking to reading your next post.
pay per head

taiseer said...



top interior designers in bangalore India's finest decorative arts for luxury home furniture and interiors. Our collection is custom created for you by our experts. we have a tendency to bring the world's best to our doorstep.welfurn is leading Interior design company that gives exquisite styles excellence in producing and Quality standards. will give door-step delivery and can complete the installation at your home.

Dr. Abdul Malik Plastic Surgeon said...

Plastic surgeon in Lahore Dr. Abdul Malik is to provide the finest Cure & Care to the cosmetic patients who want to look young and maintain their body and want to improve their appearance. Dr.Abdul Malik has the intention of providing innovative medical solutions with pioneered tested techniques and procedures under the hands of renowned Doctors, leading us to our growth in the future.
liposuction in Lahore
Hair transplant in Lahore
Facelift Surgery In Lahore
Rhinoplasty In Lahore
Tummy Tuck In Lahore
Breast augmentation In lahore
Breast Reshaping In Lahore

Gynocomastia Surgery In Lahore

smrtsmith said...

If you really need Buy Rocket League Items, the mmoah website is a good choice. This website has been operating since its inception, and has accumulated a lot of customer resources. The game gold coins and game preparation are complete. Delivery speed is also super fast

hrroman said...


If you are stuck with your Law assignment then in this case you can opt for our Law Assignment Help. we provide the bestLaw assignment writing UK.We also provideLaw Assignment and Essay Writing Help UK for students across the globe. for more information contact us +16692714848.

hrroman said...

We Fullassignment.com is among the best companies on the Programming Database and IT Assignments Help writing market. We offer top-notch essays, Online Programming Assignment Help research papers, thesis and other types of works that can be assigned to you at a high school or college. We also provide C,C Cplusplus Csharp Programming Assignment Help from our experts. for more information contact us +16692714848.

Mac Data Recovery said...

Looking to recover deleted files on your Mac? Stellar Mac Data Recovery software is a simple, effective way to take control and quickly recover deleted files on a Mac. This handy piece of tool can find a deleted file on any Mac computer or laptop.

See this tutorial to get started: youtube.com/watch?v=G-pjErWoSFQ

Zaf said...

Thank you admin for sharing this post with us. I really appreciate your hard work in writing this post. Keep uploading these types of information. Rent a Car Islamabad Without Driver Rates

Western Digital Data Recovery Mac said...

Do you use a Western Digital hard drive or other external storage product from this provider? A recent reformat, file removal, or other complication is not as big of a catastrophe as most individuals would initially think.

Go here to learn how to recover files from a WD drive: http://www.macdatarecoveryhq.com/western-digital-data-recovery-mac/

Uzma said...

Getting a romantic good night message from loved one can create the fantasy like fairy story and entire night fantastic
dua islamic wedding anniversary wishes
anniversary wishes for daughter and son in law
anniversary text messages for girlfriend
happy anniversary wishes for son and daughter in law
romantic good night messages for girlfriend

Kova Lucas said...

Working with a Freelance Virtual Assistant will allow you to worry less and accomplish more of the things that are important to you. Your lifestyle will become healthier and your business will run like a well-oiled machine. Our freelance VAs will put their skills to good use and get stuff off your plate.

From a remote location, they will be able to provide a variety of services to entrepreneurs or businesses. From digital marketing tasks to web flow development, web flow and graphic design, SEO, and content creation, we have you covered!

Services We Offer:
Webflow Developer
Webflow Design
Front-End Developer (React)
Back-End Developer (.Net)
SEO
Graphic Design
Content Writer
Private Tutor (Math, Filipino, Science)