Timestamp Formats

Using the paste helper

Next to each date or date-and-time field is a clipboard icon. Click it, paste a timestamp copied from a log source, and DFIRe parses it for you:

• A green check means the value was recognised. A preview shows the date and time that will be filled in. Click Apply to set the field.
• A red cross means the value could not be recognised. Adjust it, or close the helper and type the date and time in by hand.

The helper is a convenience for copy-pasting from varied log sources. The field can always be filled in manually instead.

How timezones are handled

DFIRe displays times in a single working timezone (UTC by default, configurable to your browser's local time). The paste helper resolves a pasted timestamp into that working timezone:

• If the timestamp carries a timezone (a trailing Z, an offset such as +02:00, or a Unix epoch), it describes an exact moment. DFIRe converts that moment into your working timezone. For example, 14:30:00 +02:00 becomes 12:30 when you are viewing in UTC.
• If the timestamp has no timezone (such as a MySQL or plain syslog value), the wall-clock time is taken exactly as written, with no shifting.

The preview always shows the resolved value, so you can confirm it before applying.

Recognised formats

DFIRe recognises the following common log and system timestamp formats. Seconds are parsed and shown in the preview, but the pickers store minute resolution.

Format	Example	Notes
ISO 8601 / RFC 3339	2026-06-24T14:30:00Z	The web and API standard. A date on its own (2026-06-24) and fractional seconds are also accepted.
ISO 8601 basic	20260624T143000Z	The compact form without separators.
RFC 5424 syslog	2026-06-24T14:30:00.123456+02:00	Modern syslog, with microseconds and a timezone offset.
RFC 3164 syslog	Jun 24 14:30:00	Legacy syslog. It carries no year, so DFIRe assumes the most recent past occurrence.
RFC 2822 / HTTP date	Tue, 24 Jun 2026 14:30:00 GMT	Email and HTTP headers. A numeric offset (+0200) or GMT / UTC is accepted; the weekday is optional.
Unix date / asctime	Tue Jun 24 14:30:00 UTC 2026	The output of the Unix date command and C asctime. The timezone word is optional.
Windows Event Log	2026-06-24T14:30:00.1234567Z	The XML system-time form, with 100-nanosecond precision.
Windows Regional (en-US)	06/24/2026 02:30:00 PM	Month-first MM/DD/YYYY, with 12-hour AM/PM or a 24-hour clock.
Apache Common Log	24/Jun/2026:14:30:00 +0000	The access-log timestamp. Surrounding brackets are stripped automatically.
MySQL DATETIME	2026-06-24 14:30:00	Space-separated date and time, with no timezone.
Unix epoch	1700000000	Seconds (10 digits) or milliseconds (13 digits) since 1 January 1970 UTC.