diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json
index bebdd6a5e..0a1d49513 100644
--- a/src/core/config/Categories.json
+++ b/src/core/config/Categories.json
@@ -20,6 +20,9 @@
"From Binary",
"To Octal",
"From Octal",
+ "To Base64",
+ "From Base64",
+ "Show Base64 offsets",
"To Base32",
"From Base32",
"To Base45",
@@ -177,6 +180,7 @@
"PGP Verify",
"PGP Encrypt and Sign",
"PGP Decrypt and Verify",
+ "Parse SSH Host Key"
"Generate RSA Key Pair",
"RSA Sign",
"RSA Verify",
@@ -241,7 +245,6 @@
"URL Encode",
"URL Decode",
"Protobuf Decode",
- "Protobuf Encode",
"VarInt Encode",
"VarInt Decode",
"JA3 Fingerprint",
@@ -265,10 +268,8 @@
"ops": [
"Encode text",
"Decode text",
- "Unicode Text Format",
"Remove Diacritics",
- "Unescape Unicode Characters",
- "Convert to NATO alphabet"
+ "Unescape Unicode Characters"
]
},
{
@@ -301,7 +302,6 @@
"Pad lines",
"Find / Replace",
"Regular expression",
- "Fuzzy Match",
"Offset checker",
"Hamming Distance",
"Levenshtein Distance",
@@ -313,7 +313,6 @@
"Convert co-ordinate format",
"Show on map",
"Parse UNIX file permissions",
- "Parse ObjectID timestamp",
"Swap endianness",
"Parse colour code",
"Escape string",
@@ -330,11 +329,22 @@
"Translate DateTime Format",
"From UNIX Timestamp",
"To UNIX Timestamp",
+ "From UNIX 32-bit Timestamp",
+ "To UNIX 32-bit Timestamp",
"Windows Filetime to UNIX Timestamp",
"UNIX Timestamp to Windows Filetime",
+ "From Mac Absolute Timestamp",
+ "To Mac Absolute Timestamp",
+ "From HFS(+) Timestamp",
+ "To HFS(+) Timestamp",
+ "From Windows 64-bit Filetime Timestamp",
+ "To Windows 64-bit Filetime Timestamp",
+ "From Chrome Browser Timestamp",
+ "To Chrome Browser Timestamp",
+ "From Firefox Browser Timestamp",
+ "To Firefox Browser Timestamp",
"DateTime Delta",
"Extract dates",
- "Get Time",
"Sleep"
]
},
@@ -355,6 +365,7 @@
"JPath expression",
"CSS selector",
"Extract EXIF",
+ "Extract Files"
"Extract ID3",
"Extract Files",
"RAKE"
@@ -397,7 +408,6 @@
"SHA1",
"SHA2",
"SHA3",
- "SM3",
"Keccak",
"Shake",
"RIPEMD",
@@ -489,7 +499,6 @@
"ops": [
"Render Image",
"Play Media",
- "Generate Image",
"Optical Character Recognition",
"Remove EXIF",
"Extract EXIF",
diff --git a/src/core/operations/FromChromeBrowserTimeStamp.mjs b/src/core/operations/FromChromeBrowserTimeStamp.mjs
new file mode 100644
index 000000000..68bd26226
--- /dev/null
+++ b/src/core/operations/FromChromeBrowserTimeStamp.mjs
@@ -0,0 +1,46 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * From Chrome Browser Timestamp operation
+ */
+class FromChromeBrowserTimestamp extends Operation {
+
+ /**
+ * FromChromeBrowserTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "From Chrome Browser Timestamp";
+ this.module = "Default";
+ this.description = "Converts Chrome Browser Timestamp to datetime string
e.g. 12883423549000000
\
+ becomes 5 April 209 16:45:49 UTC
Chrome Browser timestamp is a 17 digit value representing the number of microseconds since \
+ January 1, 1601 UTC.";
+ this.infoURL = "https://support.google.com/chrome/community?hl=en";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [];
+ }
+
+ /**
+ * @param {string} input
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const d = moment.unix((input /1000000) - 11644473600);
+ return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC";
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default FromChromeBrowserTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/FromFirefoxBrowserTimeStamp.mjs b/src/core/operations/FromFirefoxBrowserTimeStamp.mjs
new file mode 100644
index 000000000..1110f7e4c
--- /dev/null
+++ b/src/core/operations/FromFirefoxBrowserTimeStamp.mjs
@@ -0,0 +1,46 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * From Firefox Browser Timestamp operation
+ */
+class FromFirefoxBrowserTimestamp extends Operation {
+
+ /**
+ * FromFirefoxBrowserTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "From Firefox Browser Timestamp";
+ this.module = "Default";
+ this.description = "Converts Firefox Browser Timestamp to datetime string
e.g. 1341575244735000
\
+ becomes 6 July 2012 11:47:24 UTC
Firefox Browser timestamp is a 16 digit value representing the number of microseconds since \
+ January 1, 1970 UTC. Note: fractions of seconds are not retained.";
+ this.infoURL = "https://support.mozilla.org/en-US/";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [];
+ }
+
+ /**
+ * @param {string} input
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try{
+ const d = moment.unix((input /1000000));
+ return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC";
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default FromFirefoxBrowserTimestamp;
diff --git a/src/core/operations/FromHFSPlusTimeStamp.mjs b/src/core/operations/FromHFSPlusTimeStamp.mjs
new file mode 100644
index 000000000..2d1dfc4cf
--- /dev/null
+++ b/src/core/operations/FromHFSPlusTimeStamp.mjs
@@ -0,0 +1,45 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * From HFSPlus filesystem Timestamp operation
+ */
+class FromHFSPlusTimestamp extends Operation {
+
+ /**
+ * FromHFSPlusTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "From HFS(+) Timestamp";
+ this.module = "Default";
+ this.description = "Converts Apple HFS/HFS+ Filesystem Timestamp to datetime string
e.g. CDF566EE
becomes 30 June 2013 04:39:10 UTC
Mac HFS/HFS+ timestamp is a 4 Byte Hex String representing the number of seconds since January 1, 1904 UTC
Use with swap endianness recipe if required.";
+ this.infoURL = "https://en.wikipedia.org/wiki/HFS_Plus";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [];
+ }
+
+ /**
+ * @param {string} input
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const h = parseInt(input, 16);
+ const d = moment.unix(h - 2082844800);
+ return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC";
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default FromHFSPlusTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/FromMacAbsoluteTimestamp.mjs b/src/core/operations/FromMacAbsoluteTimestamp.mjs
new file mode 100644
index 000000000..045e02337
--- /dev/null
+++ b/src/core/operations/FromMacAbsoluteTimestamp.mjs
@@ -0,0 +1,44 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * From Mac Absolute Timestamp operation
+ */
+class FromMacAbsoluteTimestamp extends Operation {
+
+ /**
+ * FromMacAbsoluteTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "From Mac Absolute Timestamp";
+ this.module = "Default";
+ this.description = "Converts Apple Mac Absolute Timestamp to datetime string
e.g. 591621300
becomes Tue 1 October 2019 11:15:00 UTC
Mac Absolute timestamp is a 32-bit value representing the number of seconds since January 1, 2001 UTC";
+ this.infoURL = "https://developer.apple.com/documentation/corefoundation/cfabsolutetime";
+ this.inputType = "number";
+ this.outputType = "string";
+ this.args = [];
+ }
+
+ /**
+ * @param {number} input
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const d = moment.unix(input + 978307200);
+ return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC";
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default FromMacAbsoluteTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/FromUNIX32bitTimeStamp.mjs b/src/core/operations/FromUNIX32bitTimeStamp.mjs
new file mode 100644
index 000000000..e5b863bcd
--- /dev/null
+++ b/src/core/operations/FromUNIX32bitTimeStamp.mjs
@@ -0,0 +1,47 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * From UNIX 32bit filesystem Timestamp operation
+ */
+class FromUNIX32bitTimestamp extends Operation {
+
+ /**
+ * FromUNIX32bitTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "From UNIX 32-bit Timestamp";
+ this.module = "Default";
+ this.description = "Converts UNIX 32-bit Hex Timestamp to datetime string
e.g. 51C3C311
becomes 21 June 2013 03:05:53 UTC
UNIX 32-bit timestamp is a 4 Byte Hex value representing the number of seconds since January 1, 1970 UTC
Use with swap endianness recipe if required.";
+ this.infoURL = "https://wikipedia.org/wiki/Unix_time";
+ this.inputType = "string";
+ this.outputType = "string";
+
+
+ this.args = [];
+ }
+
+ /**
+ * @param {string} input
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const h = parseInt(input, 16);
+ const d = moment.unix(h);
+ return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC";
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default FromUNIX32bitTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/FromWindows64bitTimeStamp.mjs b/src/core/operations/FromWindows64bitTimeStamp.mjs
new file mode 100644
index 000000000..164f24934
--- /dev/null
+++ b/src/core/operations/FromWindows64bitTimeStamp.mjs
@@ -0,0 +1,46 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * From Windows 64bit Filesystem Timestamp operation
+ */
+class FromWindows64bitTimestamp extends Operation {
+
+ /**
+ * FromWindows64bitFilesystemTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "From Windows 64-bit Filetime Timestamp";
+ this.module = "Default";
+ this.description = "Converts Windows 64-bit Hex Filetime Timestamp to datetime string
e.g. 01CEE16F415343EE
becomes 14 November 2013 19:21:19 UTC
windows 64-bit filetime timestamp is a 8 Byte Hex value representing the number of 100s of nanoseconds since January 1, 1601 UTC
Use with swap endianness recipe if required.";
+ this.infoURL = "https://en.wikipedia.org/wiki/System_time";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [];
+ }
+
+ /**
+ * @param {string} input
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const h = parseInt(input, 16);
+ const secs = h/10000000;
+ const d = moment.unix(secs - 11644473600);
+ return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC";
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default FromWindows64bitTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/ToChromeBrowserTimeStamp.mjs b/src/core/operations/ToChromeBrowserTimeStamp.mjs
new file mode 100644
index 000000000..127661230
--- /dev/null
+++ b/src/core/operations/ToChromeBrowserTimeStamp.mjs
@@ -0,0 +1,53 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * To Chrome Browser Timestamp operation
+ */
+class ToChromeBrowserTimestamp extends Operation {
+
+ /**
+ * ToChromeBrowserTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "To Chrome Browser Timestamp";
+ this.module = "Default";
+ this.description = "Converts datetime string to Chrome Browser Timestamp
e.g. 5 April 2009 16:45:49 UTC
\
+ becomes 12883423549000000
Chrome Browser timestamp is a 17 digit value representing the number of microseconds since January 1, 1601 UTC.";
+ this.infoURL = "https://support.google.com/chrome/community?hl=en";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [
+ {
+ "name": "Show parsed datetime",
+ "type": "boolean",
+ "value": true
+ }
+ ];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const [showDateTime] = args,d = moment.utc(input);
+ let result = ((d.unix()+11644473600) * 1000000);
+ return showDateTime ? `${result} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : result.toString();
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default ToChromeBrowserTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/ToFirefoxBrowserTimeStamp.mjs b/src/core/operations/ToFirefoxBrowserTimeStamp.mjs
new file mode 100644
index 000000000..f2a1506c4
--- /dev/null
+++ b/src/core/operations/ToFirefoxBrowserTimeStamp.mjs
@@ -0,0 +1,54 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * To Firefox Browser Timestamp operation
+ */
+class ToFirefoxBrowserTimestamp extends Operation {
+
+ /**
+ * ToFirefoxBrowserTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "To Firefox Browser Timestamp";
+ this.module = "Default";
+ this.description = "Converts datetime string to Firefox Browser Timestamp
e.g. 6 July 2012 11:47:24 UTC
\
+ becomes 1341575244735000
Firefox Browser timestamp is a 16 digit value representing the number of microseconds since \
+ January 1, 1970 UTC. Note: fractions of seconds are not retained.";
+ this.infoURL = "https://support.mozilla.org/en-US/";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [
+ {
+ "name": "Show parsed datetime",
+ "type": "boolean",
+ "value": true
+ }
+ ];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const [showDateTime] = args,d = moment.utc(input);
+ let result = (d.unix() * 1000000);
+ return showDateTime ? `${result} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : result.toString();
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default ToFirefoxBrowserTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/ToHFSPlusTimeStamp.mjs b/src/core/operations/ToHFSPlusTimeStamp.mjs
new file mode 100644
index 000000000..b8308dc30
--- /dev/null
+++ b/src/core/operations/ToHFSPlusTimeStamp.mjs
@@ -0,0 +1,53 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * To HFSPlus filesystem Timestamp operation
+ */
+class ToHFSPlusTimestamp extends Operation {
+
+ /**
+ * ToHFSPlusTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "To HFS(+) Timestamp";
+ this.module = "Default";
+ this.description = "Converts datetime string to Apple HFS/HFS+ Filesystem Timestamp
e.g. 30 June 2013 04:39:10 UTC
becomes CDF566EE
Mac HFS/HFS+ timestamp is a 4 Byte Hex String representing the number of seconds since January 1, 1904 UTC
Use with swap endianness recipe if required.";
+ this.infoURL = "https://en.wikipedia.org/wiki/HFS_Plus";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [
+ {
+ "name": "Show parsed datetime",
+ "type": "boolean",
+ "value": true
+ }
+ ];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const [showDateTime] = args,d = moment.utc(input);
+ let result = d.unix();
+ const hexString = (result + 2082844800).toString(16);
+ return showDateTime ? `${hexString.toUpperCase()} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)`: hexString.toUpperCase();
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default ToHFSPlusTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/ToMacAbsoluteTimestamp.mjs b/src/core/operations/ToMacAbsoluteTimestamp.mjs
new file mode 100644
index 000000000..b12519bcd
--- /dev/null
+++ b/src/core/operations/ToMacAbsoluteTimestamp.mjs
@@ -0,0 +1,52 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * To Mac Absolute Timestamp operation
+ */
+class ToMacAbsoluteTimestamp extends Operation {
+
+ /**
+ * FromMacAbsoluteTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "To Mac Absolute Timestamp";
+ this.module = "Default";
+ this.description = "Converts datetime string to Apple Mac Absolute Timestamp
e.g. Tue 1 October 2019 11:15:00 UTC
becomes 591621300
Mac Absolute timestamp is a 32-bit value representing the number of seconds since January 1, 2001 UTC";
+ this.infoURL = "https://developer.apple.com/documentation/corefoundation/cfabsolutetime";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [
+ {
+ "name": "Show parsed datetime",
+ "type": "boolean",
+ "value": true
+ }
+ ];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const [showDateTime] = args,d = moment.utc(input);
+ let result = (d.unix()-978307200);
+ return showDateTime ? `${result} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : result.toString();
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default ToMacAbsoluteTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/ToUNIX32bitTimeStamp.mjs b/src/core/operations/ToUNIX32bitTimeStamp.mjs
new file mode 100644
index 000000000..85d3314a3
--- /dev/null
+++ b/src/core/operations/ToUNIX32bitTimeStamp.mjs
@@ -0,0 +1,53 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * To UNIX 32bit filesystem Timestamp operation
+ */
+class ToUNIX32bitTimestamp extends Operation {
+
+ /**
+ * ToUNIX32bitTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "To UNIX 32-bit Timestamp";
+ this.module = "Default";
+ this.description = "Converts datetime string to UNIX 32-bit Hex Timestamp
e.g. 21 June 2013 03:05:53 UTC
becomes 51C3C311
UNIX 32-bit timestamp is a 4 Byte Hex value representing the number of seconds since January 1, 1970 UTC
Use with swap endianness recipe if required.";
+ this.infoURL = "https://wikipedia.org/wiki/Unix_time";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [
+ {
+ "name": "Show parsed datetime",
+ "type": "boolean",
+ "value": true
+ }
+ ];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const [showDateTime] = args,d = moment.utc(input);
+ let result = d.unix();
+ const hexString = result.toString(16);
+ return showDateTime ? `${hexString.toUpperCase()} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : hexString.toUpperCase();
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default ToUNIX32bitTimestamp;
\ No newline at end of file
diff --git a/src/core/operations/ToWindows64bitTimeStamp.mjs b/src/core/operations/ToWindows64bitTimeStamp.mjs
new file mode 100644
index 000000000..1eae4f697
--- /dev/null
+++ b/src/core/operations/ToWindows64bitTimeStamp.mjs
@@ -0,0 +1,54 @@
+/**
+ * @author mykulh [mykulh@yahoo.co.uk]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import moment from "moment-timezone";
+
+/**
+ * To Windows 64bit filesystem Timestamp operation
+ */
+class ToWindows64bitTimestamp extends Operation {
+
+ /**
+ * ToWindows64bitFilesystemTimestamp constructor
+ */
+ constructor() {
+ super();
+ this.name = "To Windows 64-bit Filetime Timestamp";
+ this.module = "Default";
+ this.description = "Converts datetime string to Windows 64-bit Hex Filetime Timestamp
e.g. 14 November 2013 19:21:19 UTC
becomes
01CEE16F415343EE
windows 64-bit filetime timestamp is a 8 Byte Hex value representing the number of 100s of nanoseconds since January 1, 1601 UTC
Use with swap endianness recipe if required.";
+ this.infoURL = "https://en.wikipedia.org/wiki/System_time";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [
+ {
+ "name": "Show parsed datetime",
+ "type": "boolean",
+ "value": true
+ }
+ ];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ * @throws {OperationError} if invalid unit
+ */
+ run(input, args) {
+ try {
+ const [showDateTime] = args,d = moment.utc(input);
+ let result = d.unix();
+ const step1 = result + 11644473600;
+ const hexString = (step1 * 10000000).toString(16);
+ return showDateTime ? `${hexString.toUpperCase()} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : hexString.toUpperCase();
+ } catch {
+ throw new OperationError("Unrecognised format");
+ }
+ }
+}
+export default ToWindows64bitTimestamp;
\ No newline at end of file