Decoding the DateCreated and DateLastConnected SSID values From Vista/Win 7

This information was provided to me by Longshot (Just passing this great information along).

Decoding the DateCreated and DateLastConnected registry values from the registry keys

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}

In Vista and Windows 7

The DateCreated and DateLastConnected are binary values that can be broken up into 4 byte parts, with 1 part left over. Each 4 byte part corresponds to a value of a date. The order of the values are as follows:

Year
Month
Weekday
Day
Hour
Minutes
Seconds

Each of these 4 byte parts is in little endian. Using the following data that was unpacked from binary and converted to hex we get the following translation:

d9070200020018001700140025000001

d907 0200 0200 1800 1700 1400 2500 0001


Year = h4 = d907 = 07d9 = 2009

Month = h4 = 0200 = 0002 = Month {Jan = 1, Feb = 2, etc....}

Weekday = h4 = 0200 = 0020 = Weekday {Sunday = 0, Monday = 1, etc...}

date = h4 = 1800 = 0018 = 24

hour = h4 = 1700 = 0017 = 23

minutes = h4 = 1400 = 0014 = 20

Seconds = h4 = 2500 = 0025 = 37

The Month and Weekday fields have to be converted to their proper Month and weekday name.

which would yield the following:

Date First Connected: Tuesday, 24 February 2009 23:20:37

Here is the perl code to do the above, I only include the $data as a place holder that would need to get data fed to it:


use strict;

# This is the binary data that would be read from the registry file
my $data = "";

my %month_type = (1 => "January",
2 => "February",
3 => "March",
4 => "April",
5 => "May",
6 => "June",
7 => "July",
8 => "August",
9 => "September",
10 => "October",
11 => "November",
12 => "December");

my %dayofweek_type = (0 => "Sunday",
1 => "Monday",
2 => "Tuesday",
3 => "Wednesday",
4 => "Thursday",
5 => "Friday",
6 => "Saturday");


my ($year, $month, $weekday, $date, $hour, $minute, $second ) = unpack("h4 h4 h4 h4 h4 h4 h4", $data);

#This part converts the year
my $finalyear= hex(reverse $year);

#Now we convert the month
my $monthnumber=hex(reverse $month);
my $finalmonth = $month_type{$monthnumber};

#Now we convert the weekday
my $weekdaynumber=hex(reverse $weekday);
my $finalweekday = $dayofweek_type{$weekdaynumber};

# This converts the date
my $finaldate=hex(reverse $date);

#This converts the hour
my $finalhour=hex(reverse $hour);

#This converts the minute
my $finalminute=hex(reverse $minute);
my $howlongisfinalminute=length($finalminute);
if ($howlongisfinalminute == 1){
$finalminute="0$finalminute";
}
if ($finalminute eq "0"){
$finalminute='00';
}

#This converts the second
my $finalsecond=hex(reverse $second);
my $howlongisfinalsecond=length($finalsecond);
if ($howlongisfinalsecond == 1){
my $finalsecond="0$finalsecond";
}
if ($finalsecond eq "0"){
$finalsecond='00';
}

my $ssidtimestamp= "$finalweekday, $finaldate $finalmonth $finalyear $finalhour:$finalminute:$finalsecond";
if ($n =~ /Created/){
$finaln="Date First Connected:";
} else {
$finaln="Date Last Connected:";
}

print "$finaln $ssidtimestamp\n";

Update Skype Log Parser..........

I know this whole blog has gotten pretty stale as there have not been any posts in a loooong time. Well I am going to try and remedy that with some good posts in the coming weeks.

Well the skype log parser, which is my most downloaded tool, has gone through a few updates since I last posted at the end of last year/beginning of this year. The current version is 1.7. A few of the notable changes are (for full list see change_log.txt):

1. Ability to search for the log files from the gui.
2. Skype 4.x is now supported.
3. The ability to merge 2 cases into 1 report to compare the reports.
4. Ability to cancel the program at anytime.
5. Ability to parse the iTunes iPhone/iPod Touch backup files and get the skype log files if skype is installed.
6. If record in UserXXXXX.dbb file was truncated would throw program into infinite loop and this has been fixed.

The new program can be found here. I have also created a new email account that I would like to use for support and also to send out email's to users when I update the program. If you would like to receive updates about the skype log parser send an email to skype-parser at redwolfcomputerforensics dot com. Comments are encouraged good or bad and requests for enhancements.

As always Thoughts/Comments/Questions.........