Binary-Coded Decimal Timestamps

Introduction

Following on from the release of Digital Detective’s free DCode™ tool, we are compiling a series of blog posts explaining the various timestamp formats available in the new version. In this post, we are looking at Binary-Coded Decimal or BCD.

Binary-Coded Decimal (BCD)

Binary-Coded Decimal is a system for encoding decimal numbers as a series of bits suitable for use in electronic systems. Rather than converting numbers into binary, BCD splits the number up into digits and encodes each value as a 4-bit nibble.

The following table shows the difference between numbers 0 to 15 encoded as Binary and Binary-Coded Decimal:

For numbers 0 to 9, both Binary and Binary-Coded Decimal have equal 4-bit values. For values 10 to 99, the Binary-Coded Decimal system requires 8-bits to encode the number.

One of the advantages this system has for the observer is that BCD encoded values viewed in Hexadecimal format can be easily read without having to be converted.

Timestamps

During a digital forensic examination, timestamps can be found encoded in a wide variety of weird and wonderful formats. In the case of BCD timestamps, they are usually found in data recovered from mobile handsets in the non-smartphone category.

Binary-Coded Decimal (48-bit)

This timestamp uses six bytes to store a date and time value. In this case, it uses one byte to store the year part:

21 08 03 08 33 49

If we split this value into its component parts, we end up with:

Therefore, the bytes 21 08 03 08 33 49 represents 2021-08-03 08:33:49. We can see the decoded value in DCode™ below:

 

 

Extended Binary-Coded Decimal (56-bit)

This timestamp is similar to the one above; however, in this case it uses two bytes to store the year part, resulting in a total of seven bytes for the full value.

20 21 08 03 11 05 18

If we split this value into its component parts, we end up with:

Therefore, the bytes 20 21 08 03 11 05 18 represents 2021-08-03 11:05:18. We can see the decoded value in DCode™ below:

 

 

Binary-Coded Decimal (Reverse Nibble)

This timestamp is similar to the first timestamp we examined. It uses six bytes to store the date and time value. However, in this case, the nibble for each byte is reversed. The easiest way to understand this is to look at an example:

12 80 40 41 24 95

Before we assign each byte to its associated component part, we must first swap each nibble back to its original position. The first byte 12 becomes 21 and the process continues to the end of the bytes:

21 08 04 14 42 59

Now if we split this value into its component parts, we end up with:

Therefore, the original bytes 12 80 40 41 24 95 represents 2021-08-04 14:42:59. We can see the decoded value in DCode™ below:

 

 

Global System for Mobile Communications (GSM) Timestamp

This timestamp is used in digital cellular telecommunications and is outlined in the technical specification GSM 03.40.

This value is similar to the reverse nibble Binary-Coded Decimal timestamp outlined above. However, in this version, we need an additional byte to represent the time zone offset.

This value indicates the difference, expressed in quarters of an hour, between the local time and UTC. The most significant bit of the seventh byte represents the algebraic sign of this difference (0 is positive, 1 is negative).

As before, the easiest way to understand this is to breakdown an example:

12 80 40 32 84 64 8A

Before we assign each byte to its associated component part, we must first swap each nibble back to its original position. The first byte 12 becomes 21 and the process continues to the end of the bytes:

21 08 04 23 48 46 A8

Now if we split this value into its component parts, we end up with:

If the most significant bit of the first nibble is set to 1 (time zone byte), then the offset will be negative. If we convert the value to binary, we get the following:

A8 = 1010 1000

In the case above, the most significant bit is set to 1 (this is the left-most bit on the left-most nibble), this means the time zone offset will be a negative value. Next, we take the remaining bits and examine their value (remember the most significant bit is used as a marker for the algebraic sign):

0010 1000 = 28
28 x 15 minute intervals = -420 minutes offset

Therefore, the original bytes 12 80 40 32 84 64 8A represents 2021-08-04 23:48:46 -07:00. We can see the decoded value in DCode™ below: