Decipher "date_added" numbers when Autopsy does not?

Autopsy Help
1

Good afternoon,

If anyone can help me out with this issue, it would be greatly appreciated. Hopefully I can explain it well enough
.
I am currently within the file path of …Edge/User Data/Default/Bookmarks and for some reason, certain bookmarks display Date Created details (which is what I need) underneath the Results tab, while others do not. However, in the text tab, these same Bookmarks also display “date_added” and a subsequent long number, for example;

“date_added”: “13218220115833135”

Is there a way to read / convert this number to a Date/Time?

Thanks for the help!

Let me know if you have further questions.

jdd

2

The date/time is an ldap/filetime timestamp. If you go here LDAP, Active Directory & Filetime Timestamp Converter you can convert the timestamp to human readable. You may have to add a zero on the end to get the timestamp to renender correctly. At least that is what I had to do when I tried it.

3

Hello Goodnight,

I also have this problem, how can you find a solution?