Tuesday, August 25, 2009

Decoding the DateCreated and DateLastConnected SSID values From Vista/Win 7

This information was provided to me by Longshot (Just passing this great information along).

Decoding the DateCreated and DateLastConnected registry values from the registry keys

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}

In Vista and Windows 7

The DateCreated and DateLastConnected are binary values that can be broken up into 4 byte parts, with 1 part left over. Each 4 byte part corresponds to a value of a date. The order of the values are as follows:

Year
Month
Weekday
Day
Hour
Minutes
Seconds

Each of these 4 byte parts is in little endian. Using the following data that was unpacked from binary and converted to hex we get the following translation:

d9070200020018001700140025000001

d907 0200 0200 1800 1700 1400 2500 0001


Year = h4 = d907 = 07d9 = 2009

Month = h4 = 0200 = 0002 = Month {Jan = 1, Feb = 2, etc....}

Weekday = h4 = 0200 = 0020 = Weekday {Sunday = 0, Monday = 1, etc...}

date = h4 = 1800 = 0018 = 24

hour = h4 = 1700 = 0017 = 23

minutes = h4 = 1400 = 0014 = 20

Seconds = h4 = 2500 = 0025 = 37

The Month and Weekday fields have to be converted to their proper Month and weekday name.

which would yield the following:

Date First Connected: Tuesday, 24 February 2009 23:20:37


Here is the perl code to do the above, I only include the $data as a place holder that would need to get data fed to it:


use strict;

# This is the binary data that would be read from the registry file
my $data = "";

my %month_type = (1 => "January",
2 => "February",
3 => "March",
4 => "April",
5 => "May",
6 => "June",
7 => "July",
8 => "August",
9 => "September",
10 => "October",
11 => "November",
12 => "December");

my %dayofweek_type = (0 => "Sunday",
1 => "Monday",
2 => "Tuesday",
3 => "Wednesday",
4 => "Thursday",
5 => "Friday",
6 => "Saturday");


my ($year, $month, $weekday, $date, $hour, $minute, $second ) = unpack("h4 h4 h4 h4 h4 h4 h4", $data);

#This part converts the year
my $finalyear= hex(reverse $year);

#Now we convert the month
my $monthnumber=hex(reverse $month);
my $finalmonth = $month_type{$monthnumber};

#Now we convert the weekday
my $weekdaynumber=hex(reverse $weekday);
my $finalweekday = $dayofweek_type{$weekdaynumber};

# This converts the date
my $finaldate=hex(reverse $date);

#This converts the hour
my $finalhour=hex(reverse $hour);

#This converts the minute
my $finalminute=hex(reverse $minute);
my $howlongisfinalminute=length($finalminute);
if ($howlongisfinalminute == 1){
$finalminute="0$finalminute";
}
if ($finalminute eq "0"){
$finalminute='00';
}

#This converts the second
my $finalsecond=hex(reverse $second);
my $howlongisfinalsecond=length($finalsecond);
if ($howlongisfinalsecond == 1){
my $finalsecond="0$finalsecond";
}
if ($finalsecond eq "0"){
$finalsecond='00';
}

my $ssidtimestamp= "$finalweekday, $finaldate $finalmonth $finalyear $finalhour:$finalminute:$finalsecond";
if ($n =~ /Created/){
$finaln="Date First Connected:";
} else {
$finaln="Date Last Connected:";
}

print "$finaln $ssidtimestamp\n";

36 comments:

Keydet89 said...

Here's the code I use in the RegRipper plugin I wrote:

sub parseDate128 {
my $date = $_[0];
my @months = ("Jan","Feb","Mar","Apr","May","Jun","Jul",
"Aug","Sep","Oct","Nov","Dec");
my @days = ("Sun","Mon","Tue","Wed","Thu","Fri","Sat");
my ($yr,$mon,$dow,$dom,$hr,$min,$sec,$ms) = unpack("v*",$date);
$hr = "0".$hr if ($hr < 10);
$min = "0".$min if ($min < 10);
$sec = "0".$sec if ($sec < 10);
my $str = $days[$dow]." ".$months[$mon - 1]." ".$dom." ".$hr.":".$min.":".$sec." ".$yr;
return $str;
}

Andrew H said...

Thanks folks, nice!

Anonymous said...

There is a tool out there that does this as well. It does a few others from what I have seen.

http://www.live-forensics.com/dl/DateDecoder.zip

swkenney said...

The last 4 bytes represent thousandths of a second. Range 0 to 3e7h or 0 to 999 decimal.

swkenney said...

DateDecoder.exe by the way does not handle the last 4 bytes correctly. DateDecoder.exe is the program in DateDecoder.zip mentioned above.

Chloe said...

A great post with on the topic as to how one can decode the that SSID values, using Windows 7 or Vista. Great piece of infomration shared well done....

Discount Steel Buildings

Vasily Kolobkov said...

Just in case - that date time structure is called SYSTEMTIME. It's one of the datetime representations (along with FILETIME) you can come across while parsing registry.

John said...

Nice Blogging,
UTAH : Utah Web Design http://www.adaptivitypro.com/utah-web-design/

John said...

Very good blogging,
Utah SEO Adaptivity Pro premier seo services provider based in Utah.

Web Application Development said...

What a constructive blog! Much more people should do the same! Thank you very much.

jhon said...

Just would like to know does SSID stands for Session ID or some thing else.... ?

Hair Transplant Islamabad

Unknown said...

SSID is
service set identifier

mad men season 4 dvd australia said...

I am not very good at math. so I often type the wrong nummber.

Free SMS said...

SSID values, haven't they got any relationship with WIFI setting or similar... ???

alistair1 said...

This helped with my
computer forensics work. I was stuck.

f4v to youtube said...

Some say it will be hotlink acreage as accomplished website page will be abounding of links (ads) so may be Search Engines won’t like it.

pay per head said...

Hey, there's a great deal of helpful information above!

hermes so black birkin said...

Thanks for sharing the nice pictures. You have done a great work. Every homeowner can benefit from property management services.

SIFS INDIA said...

THANK YOU!! FOR THIS BLOG!!!
SIFS INDIA
2443, Basement,
Hudson Lane,
Kingsway Camp,
Delhi - 110009
Email: education@sifsindia.com

Website: www.sifs.in

karimun jawa said...

Ingin Liburan Ke Karimunjawa , ingin Paket Wisata Karimunjawa murah, Hubungi kami Tour Karimunjawa island +6285201391216 (Syaiful) PIN BB 30c9f29c. Ayo datang ke karimun jawa bersama keluarga, dengan mengikuti paket wisata karimunjawa yang termasuk biro wisata karimun jawa berpengalaman karena memberikan paket karimun jawa murah,anda sudah Bisa menikmati Wisata Karimunjawa di pulau Karimunjawa atau Karimunjawa island. lanjut bisa menghubungi www.tourkarimunjawaisland.com. Untuk mendapatkan pilihan paket Honeymoon Karimunjawa , paket Diving Karimunjawa , paket Hotel Nirvana karimunjawa , paket omah alchy karimunjawa dan Paket Murah karimunjawa , paket hotel karimunjawa, paket homestay karimunjawa, paket 2 hari 1 malam karimunjawa, paket 3 hari 2 malam karimunjawa, paket 4 hari 3 malam karimunjawa, paket 2 h 1 m karimunjawa, paket 3 h 2 m karimunjawa, paket 4 h 3 m karimunjawa. untuk Paket karimunjawa dan karimunjawa murah, hanya di karimunjawa tour
Ingin Liburan Ke Karimunjawa , ingin Paket Wisata Karimunjawa, Hubungi kami Tour Karimunjawa dan Wisata Karimunjawa

tenun ikat said...

Amazing post, Thank you for presenting a wide variety of information that is very interesting to see in this artikle


tour karimunjawa
and toko furniture
or toko mebel
and tenun troso

tenun ikat said...

article from a very amazing, Good Job, Thank you for presenting a wide variety of information that is very interesting to see in this artikle

kursi makan mahoni
kursi makan modern
kursi makan mewah
kursi makan kayu
set kursi makan
kursi makan minimalis
meja makan mahoni
set meja makan
KURSI TAMU
sofa modern classic
kursi tamu minimalis
BUFFET
bufet besar
bufet tv minimalis
buvet tv besar
bufet ukir antik
bufet pajangan
lemari bufet
bufet jati
lemari bufet minimalis
JAM HIAS
lemari jam pajangan
jam hias jati
NAKAS
nakas duco
nakas jati
KITCHEN
kitchen set jati
set kitchen
set lemari dapur
GAZEBO
gazebo taman
GEBYOK
gebyok pelaminan
MEJA BELAJAR
meja belajar
RAK BUKU
rak buku minimalis
BANGKU
bangku ukiran jepara
bangku ukiran mewah
bangku ukiran
kursi bangku mewah

friv 2 online said...

i think i need it. Thanks for update information. Love it :) Keep on posting!.
---
Signature:
i like play games friv 2 | friv2 | friv

clickjogos said...

There is a tool out there that does this as well.
----
play game click jogos online free | jogos click | clickjogos

Facebook Descargar said...

Thanks for sharing this quality information with us. I really enjoyed reading.

Signature:
descarga facebook
descargar facebook gratis
descargar facebook plus
descargar facebook

Mas un show said...

I was working and suddenly I visits your site frequently and recommended it to me to read also. The writing style is superior and the content is relevant. Thanks for the insight you provide the readers!
Signature:
juegos de un show mas
un show mas
juego de un show mas
juego un show mas

Whatsapp Descargar said...

I was working and suddenly I visits your site frequently and recommended it to me to read also. The writing style is superior and the content is relevant. Thanks for the insight you provide the readers!
Signature:
download free descargar whatsapp gratis
baixar whatsapp gratis
descargar whatsapp
baixar whatsapp

iniciar sesion facebook entrar said...

Its really good information, i like your blog post. Thanks for sharing
Signature:
facebook entrar iniciar sesion gratis - Sitio Oficial iniciado sesión en Facebook lengua española. facebook entrar rápido, facebook iniciar sesion en tu cuenta de entrar facebook

lionelmessi10 said...

cara mengobati kemaluan keluar nanah cara mengobati kemaluan keluar nanah cara mengobati ujung kemaluan keluar nanah ujung kemaluan keluar nanah di sertai perih saat kencing ujung kemaluan keluar nanah di sertai perih saat kencing penyebab penis keluar nanah penyebab penis keluar nanah obat untuk kemaluan yang keluar nanah dan perih saat kencing penis keluar nanah pusat pengobatan herbal obat kemaluan keluar nanah mengapa kemaluan keluar nanah mengapa kemaluan keluar nanah obat penis keluar nanah obat penis keluar nanah cairan nanah keluar dari kemaluan pria cairan nanah keluar dari kemaluan pria obat cairan nanah keluar dari kemaluan obat cairan nanah keluar dari kemaluan obat cairan nanah keluar dari kemaluan cairan nanah keluar dari kemaluan cairan nanah keluar dari kemaluan kemaluan keluar nanah di sertai perih saat kencing kemaluan keluar nanah di sertai perih saat kencing

Syaiful wisata said...

very amazing post, I like It, Thank you for presenting a wide variety of information that is very interesting to see in this artikle, good job adnd succes For you

tour karimunjawa

paket wisata karimunjawa

paket wisata karimunjawa

wisata karimunjawa

paket wisata karimunjawa

paket karimunjawa

wisata karimunjawa

paket karimunjawa

wisata karimunjawa

karimunjawa tour

tour karimunjawa

tour karimunjawa

karimun jawa

karimunjawa

paket karimunjawa

paket wisata karimunjawa

wisata karimunjawa

jual tanah karimunjawa

jual tanah karimunjawa


Link Anyar
furniture jepara

mebel jepara

kain tenun

toko mebel jepara

kursi jati

furniture anak

aneka tempat tidur

harga sofa ruang tamu

toko furniture jepara

harga meja makan

sofa ruang tamu

mebel jepara online

toko furniture jati

toko kain tenun

kain tenun

sangkar burung

toko tenun ikat

juegoskizi said...

Thanks for sharing!
----
play game juegos kizi online and play game jogos do friv

Hà Trang said...

Thank you for sharing posts. it was wonderful
đồng phục||may đồng phục ||đồng phục công sở||may đồng phục công sở||đồng phục khách sạn||đồng phục bệnh viện ||đồng phục văn phòng|| sơ mi nữ

Muhammad Arifin said...

kursi tamu minimalis cocok untuk di taruh di rumah yang memiliki ruang tamu dengan ukuran Sempit dan Kecil bukan berarti anda sudah tidak bisa berinspirasi untuk mendesain ruang tamu rumah anda. mendesain ruang kursi tamu dirumah bisa dibilang gampang-gampang susah tergantung dengan keinginan kita, jika mungkin sedang memiliki Inspirasi untuk pilihan meja kursi tamu tentunya kami siap membantu anda. ada juga Set kursi meja makan luxury italian adalah model terbaru dari koleksi furniture jepara untuk kitchen room italian style, profuk furniture kursi makan ini memberikan kemewahan pada setiap detail interior rumah anda.furniture yang kami tawarkan merupakan produk terbaru dan desain custom, desain custom kami prioritaskan , karena desain custom untuk furniture yang kami jual merupakan produk yang belum pernah ada sebelumnya. untuk ruang kamar ada Set tempat tidur mewah dengan desain yang mewah dan elegan adalah Idaman bagi semua Orang untuk memilikinya ada juga bisa memiliki kamar set klasik mewah ini. Tempat tidur klasik ini adalah produk mebel jepara pilihan yang langsung dibuat oleh pengrajin mebel asal kota jepara yang sudah berpengalaman sehingga hasil kerja dan detail yang rapi dan maksimal. Set tempat tidur ini sangat cocok diterapkan di ruang kamar tidur yang memiliki ukuran yang besar serta interior ke arah eropa style. lihat produk furniture.

John Kornar said...

I am pretty much pleased with your good work.You put really very helpful information. Keep it up. Keep blogging. Looking to reading your next post.
pay per head

muhammad arifin said...

Di jepara tepatnya di desa teluk sidi ada sebuah kerajinan tangan dari bahan rotan seperti kursi rotan gantung sintetis saat ini sangat banyak di cari  oleh buyer dari luar negeri dan juga tak mau kalah , pasar dalam negeri dari perorangan maupun perusahaan juga banyak mencari produk dari rattan. Di proses langsung di kota yang terletak di ujung jawa tengah kota yang sangat terkenal dengan furniture rotan yaitu kota Jepara, lihat selengkapnya.

Toko jati mempunyai produk kursi tamu sofa duco mewah ukiran merupakan salah satu perabot ruang  tamu yang sangat anda cari untuk melengkapi kebutuhan rumah baru anda dengan nuansa mewah nan elegant. ada juga produk serupa Kursi teras jati set terbaru ini tentu berbeda dengan kursi untuk ruang tamu seperti sofa misalnya. Selain lebih simpel, jumlahnya pun tidak terlalu banyak. Ada pula furniture untuk ruang kamar yaitu set tempat tidur minimalis dengan bentuk yang unik dan cantik,cocok di taruh di ruang tidur dengan konsep apapun, bagi kebanyakan orang kamar bukan sebatas untuk tidur. tempat tidur tingkat kami sediakan untuk anda yang ingin memberi kenyamanan kepada anak-anak anda. Siapa saja pasti ingin memberi yang terbaik buat si buah hati dan sudah menyiapkan produk furniture minimalis yang terbaik untuk mengisi ruang tidur bagi si buah hati tempat tidur ini akan sangat berguna sekali bagi anda untuk melengkapi furniture rumah anda. kursi jati minimalis adalah furniture yang perlu untuk anda miliki untuk menerima tamu agar tamu merasa nyaman saat berkunjung ke rumah anda. set kursi sofa tamu kayu jati adalah sebuah produk hasil pengrajin mebel kayu jati jepara, furniture jepara terkenal akan keindahan model dan bentuk kursinya, kualitas kursi sofa jepara terkenal akan kualitas rangka kayunya sebagai bahan dasar. lemari jam hias jati brawijaya standart kami menggunakan mesin Jam Jung Han. dan untuk informasi lengkapnnya.

taiseer said...



top interior designers in bangalore India's finest decorative arts for luxury home furniture and interiors. Our collection is custom created for you by our experts. we have a tendency to bring the world's best to our doorstep.welfurn is leading Interior design company that gives exquisite styles excellence in producing and Quality standards. will give door-step delivery and can complete the installation at your home.