Timestamp converter (Unix, ISO, FILETIME, HFS+)
Convert between Unix seconds and milliseconds, ISO 8601, local time, and the non-standard epochs used by Windows, macOS, and Flask.
Open in ctfpalForensics challenges live on timelines, and the timestamps come from systems that disagree about when time started. Recognising which epoch a number uses is usually a matter of its magnitude.
The practical test is to try each interpretation and see which one produces a plausible date. A number that reads as 2019 under one epoch and as the year 51,000 under another has answered the question for you, and that is faster than reasoning about which system wrote the value.
| Epoch | Starts | Unit | Recognise by |
|---|---|---|---|
| Unix | 1970-01-01 | seconds | 10 digits today |
| Unix (ms) | 1970-01-01 | milliseconds | 13 digits |
| Windows FILETIME | 1601-01-01 | 100 ns | 18 digits |
| HFS+ / Mac | 1904-01-01 | seconds | ~2 billion higher than Unix |
| itsdangerous | 2011-01-01 | seconds | Small - used in Flask cookies |
Part of a module
9. Network forensics
Triage a packet capture: find the one conversation that matters, extract transferred files, and spot exfiltration over DNS.
Practise on real challenges
Related tools
EXIF metadata viewer
Read EXIF, GPS coordinates, camera details, timestamps, and embedded comments from images - the metadata that answers OSINT challenges.
Flask session cookie decoder
Decode and verify Flask’s itsdangerous session cookies, with automatic zlib detection and both key-derivation schemes.
PCAP analyzer for CTF network forensics
Drop a packet capture and extract HTTP objects, DNS queries, credentials, transferred files, and flags - with TLS decryption when you have the keys.
Regex tester with match offsets and capture groups
Test regular expressions live against sample text, with every match’s offset, capture groups, and named groups broken out.