{"id":51595157,"url":"https://github.com/securityronin/timeglyph","last_synced_at":"2026-07-11T18:01:36.508Z","repository":{"id":367951532,"uuid":"1282877857","full_name":"SecurityRonin/timeglyph","owner":"SecurityRonin","description":"Forensic timestamp decipherment — decode, encode \u0026 identify how systems inscribe time (scored, cited, ambiguity-first), plus a cursor-hover overlay","archived":false,"fork":false,"pushed_at":"2026-07-07T00:52:59.000Z","size":4806,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-07T01:11:05.769Z","etag":null,"topics":["cli","datetime","dfir","digital-forensics","epoch","filetime","forensics","ganzhi","holidays","incident-response","lunisolar","overlay","rust","timestamp","timezone"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-28T09:49:17.000Z","updated_at":"2026-07-07T00:53:06.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/timeglyph","commit_stats":null,"previous_names":["securityronin/timeglyph"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/timeglyph","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Ftimeglyph","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Ftimeglyph/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Ftimeglyph/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Ftimeglyph/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/timeglyph/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Ftimeglyph/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35370428,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","datetime","dfir","digital-forensics","epoch","filetime","forensics","ganzhi","holidays","incident-response","lunisolar","overlay","rust","timestamp","timezone"],"created_at":"2026-07-11T18:01:35.202Z","updated_at":"2026-07-11T18:01:36.503Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"assets/logo.png\" alt=\"timeglyph\" width=\"180\" /\u003e\n\u003c/p\u003e\n\n# timeglyph\n\n[![Crates.io](https://img.shields.io/crates/v/timeglyph.svg)](https://crates.io/crates/timeglyph)\n[![Docs.rs](https://img.shields.io/docsrs/timeglyph)](https://docs.rs/timeglyph)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/timeglyph/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/timeglyph/actions/workflows/ci.yml)\n[![Release](https://github.com/SecurityRonin/timeglyph/actions/workflows/release.yml/badge.svg)](https://github.com/SecurityRonin/timeglyph/releases)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa?logo=github-sponsors)](https://github.com/sponsors/h4x0r)\n\n**Decode any timestamp. Identify the unknown ones.**\n\nEvery examination throws raw timestamps at you — a `133801920000000000` buried in\nan artifact — that you need in human-readable time. `timeglyph` reads that value\nevery way a system might have written it and reports the results **ranked, scored,\nand cited** — honest about the ambiguity instead of guessing one answer. Convert\nin bulk from a CSV, or hover the number on screen and read the time live. No more\ncopying each one into a converter app. One static Rust binary, plus a live overlay\nthat decodes whatever is under your cursor.\n\n**[Try it in your browser →](https://securityronin.github.io/timeglyph/playground.html)** · **[Full documentation →](https://securityronin.github.io/timeglyph/)**\n\nThe playground runs the real engine as WebAssembly, entirely client-side — paste a value, see every ranked, cited reading; nothing leaves the page.\n\n```console\n$ timeglyph 1577836800\n# readings consistent with 1577836800 (ranked; a raw value is usually underdetermined — not a single verdict):\n  [1.00] unix           2020-01-01T00:00:00Z  (Unix time (seconds))\n  [0.94] postgres       2000-01-01T00:26:17.8368Z  (PostgreSQL timestamp (µs since 2000))\n  [0.67] cocoa          2051-01-01T00:00:00Z  (Cocoa / CFAbsoluteTime (s since 2001))\n  [0.67] hfsplus        1953-12-31T00:00:00Z  (Apple HFS+ (s since 1904))\n  ...\n```\n\n---\n\n## Install\n\n**macOS**\n```bash\nbrew install securityronin/tap/timeglyph\n```\n\n**Debian / Ubuntu**\n```bash\ncurl -1sLf 'https://dl.cloudsmith.io/public/securityronin/timeglyph/setup.deb.sh' | sudo -E bash\nsudo apt install timeglyph\n```\n\n**Windows**\n```powershell\nwinget install SecurityRonin.timeglyph\n```\n\n**Cargo**\n```bash\ncargo install timeglyph\n```\n\nOn macOS and Windows this also installs the\n[`timeglyph-lens`](#timeglyph-lens--hover-anything-decode-time-data) overlay.\n\n---\n\n## What you do with it\n\n### Identify an unknown value\n\n```bash\ntimeglyph 1577836800                    # ranked, scored readings across every format\ntimeglyph identify --json 1577836800    # same, machine-readable\ntimeglyph hex 0060947C58B2D501          # raw bytes: little/big-endian + packed on-disk\ntimeglyph string 20200101000000Z        # ISO / RFC 2822 / ASN.1 string forms\n```\n\nExit codes are pipeline-safe: `0` clear top reading, `2` ambiguous or a sentinel\n(review needed), `1` error. Render in any timezone with `--tz` (`UTC`, a fixed\noffset, or a DST-correct IANA name); nudge readings toward a source family with\n`--artifact \"\u003chint\u003e\"`.\n\n### Decode or encode a known format\n\n```bash\ntimeglyph decode filetime 132223104000000000\ntimeglyph encode unix 2020-01-01T00:00:00Z\ntimeglyph list                          # the format registry, with spec citations\n```\n\n### Mine artifacts at scale\n\n```bash\ntimeglyph scan app.log                  # find \u0026 decode every timestamp in text (or stdin)\ntimeglyph csv events.csv                # enrich a CSV with human-readable timestamp columns\n```\n\nConvert in bulk: enrich a whole CSV of timestamps in one pass instead of pasting\nthem into a converter one at a time.\n\n[CSV enrichment →](docs/csv.md)\n\n---\n\n## TimeGlyph Lens — hover anything, decode time data\n\nConvert live: hover any number on screen and read its time in real time. An\nalways-on-top overlay follows your cursor and shows timeglyph's ranked readings\nfor the number in the UI element under the pointer, so you never copy a value into\na converter. Each row carries its confidence, the weekday, and the public holiday\nfor that date in the chosen zone. Pick any display timezone from the footer.\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"assets/lens-in-action.png\" alt=\"timeglyph-lens decoding a SQLite timestamp column live over DB Browser for SQLite\" width=\"640\" /\u003e\n\u003c/p\u003e\n\nIt installs with the CLI on macOS and Windows and reads the element under the\ncursor through the platform accessibility layer — the Accessibility API on macOS,\nUI Automation on Windows. (Linux support is in progress.)\n\n[Overlay guide →](docs/lens.md)\n\n---\n\n## Formats\n\n`timeglyph` decodes and auto-identifies:\n\n- **Epoch integers** — Unix (s/ms/µs/ns), FILETIME (incl. Active Directory / LDAP),\n  WebKit/Chrome, Cocoa / CFAbsoluteTime (integer, signed double, iOS-11 ns),\n  Apple HFS+, .NET ticks, OLE automation, Excel-1904, PostgreSQL, Mozilla PRTime,\n  SQLite Julian day\n- **Embedded IDs** — KSUID, ULID, UUIDv1 / v6 / v7, MongoDB ObjectId, and\n  Snowflake-class IDs (Twitter/X, Discord, Mastodon, LinkedIn, TikTok)\n- **Packed on-disk** — FAT/DOS date-time words and 128-bit SYSTEMTIME structs\n- **Strings** — ISO 8601 / RFC 3339, RFC 2822 email dates, EXIF, ASN.1\n  GeneralizedTime \u0026 UTCTime\n\nEvery reading names the spec it assumes and is scored on window membership,\ngranularity, magnitude, byte-width, endianness, artifact context, and neighbour\nmonotonicity. Correctness is checked against primary-spec worked examples and the\nMIT [`time_decode`](https://github.com/digitalsleuth/time_decode) oracle — see\n[validation](docs/validation.md).\n\n---\n\n## Why another converter?\n\nGood ones exist ([`time_decode`](https://github.com/digitalsleuth/time_decode),\nMIT; DCode, proprietary). `timeglyph` is a single static Rust binary built on a\n**rigorous, cited model** where a reading is *evidence, not a verdict*: a\nPOSIX-correct internal spine (never mislabelled UTC), the leap-second family kept\nseparate, and **ambiguity as first-class, scored output**. Calendar and timezone\nmath is reused (`jiff`), never reinvented. See\n[the design decisions](docs/decisions/).\n\n---\n\n[Privacy Policy](https://securityronin.github.io/timeglyph/privacy/) · [Terms of Service](https://securityronin.github.io/timeglyph/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Ftimeglyph","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Ftimeglyph","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Ftimeglyph/lists"}