Forensic timestamp decipherment — decode, encode, and identify the many ways systems inscribe time, with scored, cited, ambiguity-first interpretation.
A timestamp is time inscribed as a symbol — the raw integer or bytes a system
writes to mean an instant. timeglyph deciphers those inscriptions. Given an
unknown value it reports every plausible interpretation, ranked and scored,
with its assumptions — never a single "detected" answer, because a raw value is
usually ambiguous.
$ timeglyph 1577836800
# readings consistent with 1577836800 (ranked; a raw value is usually underdetermined — not a single verdict):
[1.00] unix 2020-01-01T00:00:00Z (Unix time (seconds))
[0.94] postgres 2000-01-01T00:26:17.8368Z (PostgreSQL timestamp (µs since 2000))
[0.67] cocoa 2051-01-01T00:00:00Z (Cocoa / CFAbsoluteTime (s since 2001))
[0.67] hfsplus 1953-12-31T00:00:00Z (Apple HFS+ (s since 1904))
...
$ timeglyph identify --json 1577836800 # machine-readable ranked candidates
$ timeglyph decode filetime 132223104000000000
$ timeglyph encode unix 2020-01-01T00:00:00Z
$ timeglyph hex 0060947C58B2D501 # raw bytes (LE/BE + packed on-disk)
$ timeglyph string 20200101000000Z # ISO / RFC / ASN.1 string forms
$ timeglyph csv events.csv # enrich a CSV: human-readable timestamp columns
$ timeglyph list # the format registry, with spec citationsExit codes are pipeline-safe: 0 clear top reading, 2 ambiguous or a sentinel
(review needed), 1 error.
Working engine. The PosixNs(i128) spine, decode/encode/auto-detect/byte-decode,
component-based plausibility scoring, and epistemic framing (consistent-with +
leap-smear) are in and tested against primary-spec anchors. The registry covers
Unix s/ms/µs/ns, FILETIME, WebKit/Chrome, Cocoa (integer and signed-double),
HFS+, .NET ticks, OLE, PostgreSQL, SQLite Julian day, Snowflake IDs (Twitter/X,
Discord), and FAT/DOS packed local time. The leap-aware GPS/TAI64/NTP family is
implemented behind the leap feature (decode gps|tai64|ntp, leap-correct UTC
via hifitime). Remaining build-out (more packed/string forms, distribution) —
see HANDOFF.md for the design record and plan.
Honestly: good ones exist (time_decode,
MIT; DCode, proprietary). timeglyph isn't "the first" — it's a Rust single static
binary and a rigorous, cited model where a reading is evidence, not a verdict:
a POSIX-correct internal spine (never mislabelled UTC), the leap-second family kept
separate, and ambiguity as first-class scored output. Calendar/timezone math is
reused (jiff), never reinvented; the leap-aware family will delegate to hifitime.
Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd