5

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.

There are 2 values in one file (reversed from LE):

DATE1: 41 C0 A0 72 E7 F5 F6 A9
DATE2: 41 C0 A0 72 E9 2B 82 BA

One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how.

These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.

Here's another example:

41 BB 67 A9 0A 00 00 00 --> 7/28/2015 12:11:54 UTC

Any help greatly appreciated.

Matt Hovey
  • 53
  • 2

1 Answers1

7

It's a 64 bit floating point value.

See here: https://developer.apple.com/documentation/foundation/nsdate

Returns a TimeInterval which happens to be typealias TimeInterval = Double

Ref: https://developer.apple.com/documentation/foundation/timeinterval

As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.

41 BB 67 A9 0A 00 00 00 is about 459778314 seconds which is Jul 28 2015, 12:11:54 PM

41 C0 A0 72 E7 F5 F6 A9 is about 557901263 which is Sep 6 2018, 6:34:23 AM UTC

41 C0 A0 72 E9 2B 82 BA is about 557901266 which is Sep 6 2018, 6:34:26 AM UTC

Abigail
  • 684
  • 3
  • 9