What timestamp format is 48 bits / 6 bytes long?

user_1747979 0
Viewed 3398

I've got a file that has a timestamp format I don't understand. I don't have access to the code that create the file and it isn't a standard format, so I'm going through piece by piece in a hex editor, and I've found a timestamp in a format I can't find information on.

It's a 48 bit number with:
12 bits for the year (starting at 0)
4 bits for the month (this year)
5 bits for the day (this month)
5 bits for the hour (this day)
6 bits for the minute (this hour)
6 bits for the second (this minute)
10 bits for the millisecond (this second)

And it's written in UTC time, which was not the time the system was in, so I suspect the time zone is written nearby in the file.

So for instance if you wanted to write 2019-06-16 19:11:22.333 it would be

          2019  -06   -16    19    :11    :22       .333
0b011111100011 0110 10000 10011 001011 010110 0101001101

aka

0b01111110 00110110 10000100 11001011 01011001 01001101

aka

0x7E 36 84 CB 59 4D

Fortunately I already knew the approx date/time so I could work backwards, but I've been trying to google this to find more information on this format (or if I've missed anything) and I'm coming up empty. Has anyone seen this before and would have a name I could look for?

EDIT: I'm now almost certain the 0xE0 80 I'm seeing next to this timestamp in the wild is related to it being PDT (-7h).

The best list I've found of timestamp data formats online is https://sqliteforensictoolkit.com/a-brief-history-of-time-stamps/ but sadly it doesn't have this one.

timestamp
1 Answers

This is one possible answer to the question headline, but is about a different encoding than the one described in the question's details.

IEC 61375-1 (Electric railway equipment - Train bus - Part 1: Train communication network) 2nd edition 2007-04 defines a data type called TIMEDATE48:

A structured type expressing the absolute time in number of seconds since Universal Co-ordinated Time (UTC), 00:00:00, 1st January 1970 (Unix and ANSI-C format).

TimeDate48 ::= RECORD
{
  seconds    SIGNED32,    -- elapsed since 1970, January 1st, 00:00
  ticks      UNSIGNED16   -- fraction of seconds (1 tick = 1/65536s)
}
user_108721600
Related