What kind of date stamp is this?

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA


One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC


Any help greatly appreciated.

1 Answer
1

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

TimeInterval

typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 BB 67 A9 0A 00 00 00

459778314

Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E7 F5 F6 A9

557901263

Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

41 C0 A0 72 E9 2B 82 BA

557901266

Sep 6 2018, 6:34:26 AM UTC

Thanks for contributing an answer to Reverse Engineering Stack Exchange!

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.