Convert Unix and NT Timestamps in Regedit

When inspecting values in the Windows Registry (Regedit), dates are rarely stored in standard calendar formats. Instead, Windows and third-party applications typically store time values as raw integers representing either Windows NT timestamps (FILETIME) or Unix epoch timestamps. This guide provides direct, practical methods to identify these values and convert them into standard, human-readable date and time formats using built-in Windows tools like PowerShell and the Command Prompt.

1. Identifying the Timestamp Format

Before converting, determine which timestamp structure is used by checking the Registry value type and length:

• Windows NT Timestamp (FILETIME / 64-bit integer): Represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). These are commonly found as REG_QWORD (64-bit) or 8-byte REG_BINARY values (e.g., 133456789012345678 or 0x01D9E5A3...).
• Unix Epoch Timestamp (32-bit or 64-bit integer): Represents the number of seconds elapsed since January 1, 1970 (UTC). These are commonly stored as REG_DWORD (32-bit) or REG_QWORD values (e.g., 1700000000 or 0x65540D00).

2. Converting Windows NT (FILETIME) Timestamps

Using PowerShell (Recommended)

PowerShell provides a built-in method ([DateTime]::FromFileTime) to translate 64-bit Windows timestamps directly.

1. Open PowerShell.
2. Run the following command, replacing <TIMESTAMP> with the decimal or hexadecimal value from Regedit:

[DateTime]::FromFileTime(133456789012345678)

If the value is in hexadecimal (prefix with 0x):

[DateTime]::FromFileTime(0x01DA24119B3E8C4E)

To display the output in Universal Time (UTC):

[DateTime]::FromFileTimeUtc(0x01DA24119B3E8C4E)

Using Command Prompt (w32tm)

Windows includes a built-in time diagnostic utility (w32tm) that converts NT timestamps from the command line:

w32tm /ntte 0x01DA24119B3E8C4E

3. Converting Unix Epoch Timestamps

Using PowerShell

For Unix timestamps measured in seconds, use .NET’s DateTimeOffset class:

1. Open PowerShell.
2. Run the following command with the decimal timestamp:

[DateTimeOffset]::FromUnixTimeSeconds(1700000000).LocalDateTime

If the timestamp is in milliseconds (13 digits):

[DateTimeOffset]::FromUnixTimeMilliseconds(1700000000000).LocalDateTime

If your Registry value is shown in hexadecimal, enter it directly with 0x:

[DateTimeOffset]::FromUnixTimeSeconds(0x65540D00).LocalDateTime

4. Handling Binary (REG_BINARY) Little-Endian Data

When Windows stores timestamps inside a REG_BINARY key, the bytes are arranged in little-endian order (e.g., 4E 8C 3E 9B 11 24 DA 01).

To convert this in PowerShell: 1. Reverse the byte sequence to form a continuous hex string (0x01DA24119B3E8C4E). 2. Pass the reversed hex string directly into [DateTime]::FromFileTime(0x01DA24119B3E8C4E).