convert search history and run history from v1.21 to v1.33

[rock888]

Thanks first for this awesome superpower tool. I've been using it since 2009. I'm using v1.2.1.442a for several years. Today I just updated to v1.3.3.656b. Everything updated smoothly except the search history and run history. They were stored in xml format in old version. However, the new version takes csv version. I wonder if there is an easy way to convert from old version to new version. Thanks again! Rock

[therube]

This, http://www.luxonsoftware.com/Converter/xmltocsv, gave back a .csv.
I viewed it & it looks right.
(I did not try "using" it in Everything.)

[rock888]

Thanks for the tool. But the date format is not correct. v1.33 just wiped them out and created an empty one.

[therube]

I see.

Current is:
> Name | Count | Date (with date in Unix time?)

Old is:
> Date | Count | Name (with date in a readable format)

So that makes it more difficult...?

[rock888]

old date format is "2013-06-12 03:01"
new is "130162241861150000"
forgot how to convert them...

[therube]

Epoch & Unix Timestamp Conversion Tools

Can probably get away with just set all the date/times to a singular value?

[rock888]

epoch time format is only 13 digit with milliseconds, but the format in search history.csv has 18 digits. Maybe only void knows this...

[void]

Everything uses FILETIMEs for search history and run history.
FILETIMEs are 100 nanosecond intervals since January 1, 1601 (UTC).

To convert unix time to FILETIME:

Code: Select all

FILETIME = (unix time * 10000000) + 116444736000000000

[therube]

Are we missing 0's?
I found:

Code: Select all

filetime = (unixtime * 10000000) + 116444736000000000

(When I was searching, I had come up with "(MACE) timestamps", but hadn't yet put everything together.)
File Times
Tim Mugherini presents NTFS MFT Timelines and Malware Analysis
MAC times

[void]

Thanks therube, updated.

[rock888]

thanks void and therube. I'll write a script to convert them later.

[Cleoss]

Hi there!

Today I've wrote a script for Clickermann 4.13.003 (ver.4.12 seems to be working too) for automatic convertation Unix-time & UTC-time (which is used in Everything EFU filelist) into usual date/time format.
Scripts are in enclosure. To use that script as include plz write

Code: Select all

#include "195_Unix2date_060318.cms"

directive in your script for connecting to my script (which should lay in the same folder as your one). Also 2 drafts of the script are in the archieve (7Zip, 3kb).

There're 3 built-in functions inside: utc2unix, unix2utc, unix2date. Each of them writes the result to the Clickerman's log, but besides this you can use their inner variables ($mult, $utctm, $dttime, $hr etc) to insert these functions' output strictly where you need it (for ex., write to ur file).

Oops, I can't find a spoiler button here, so I'll put my script's code below.

Code: Select all

// 06-Mar-2018
//#name "Unix2date"
//logclear

$subtr=11644473600

sub(utc2unix,$utctext)
   $utc=$utctext
   $utc=strcut($utc,1,11)
   $mult=$utc-$subtr
   print(" Unix = ",$mult," (",strlen($mult),") ")
end_sub

sub(unix2utc,$unixtext)
   $unix=$unixtext
   $utctm=strconcat($unix+$subtr,"0000000")
   print("utc-Time = ",$utctm," (",strlen($utctm),") ")
end_sub

sub(unix2date,$nixtime)
   $tm=$nixtime
   $conv=0
   $yr=0
   $cnt=0
   //$leap=0
   $first=1
   while($conv=0)
      define($tmrest,$tm)
      $leap=0
      $tmrest=$tmrest-31536000
      if(($tmrest>0)|($tmrest=0))
         inc($yr)
         inc($cnt)
         if($cnt=4)
            if($first=0)
               $cnt=0
               //$first=0
               $leap=1
               $tmrest=$tmrest-86400
            end_if
         end_if
         if(($cnt=3)&($first=1))
            $cnt=0//4
            $first=0
            $leap=1
            $tmrest=$tmrest-86400
         end_if
         
      else
         $conv=1
      end_if
      
   end_cyc
   $tmrest=$tmrest+31536000
   if(($yr=0)&($tmrest<0))
      print("Out of bound! (year < 1970)")
   else
      //print($yr+1970)
   end_if
   if($tmrest>(31+28+$leap+31+30+31+30+31+31+30+31+30)*86400)
      $mt="Dec"
      $m=12
      $tmrest=$tmrest-(31+28+$leap+31+30+31+30+31+31+30+31+30)*86400
      $dy=int($tmrest/86400)
      $tmrest=$tmrest-$dy*86400
   else
      if($tmrest>(31+28+$leap+31+30+31+30+31+31+30+31)*86400)
         $mt="Nov"
         $m=11
         $tmrest=$tmrest-(31+28+$leap+31+30+31+30+31+31+30+31)*86400
         $dy=int($tmrest/86400)
         $tmrest=$tmrest-$dy*86400
      else
         if($tmrest>(31+28+$leap+31+30+31+30+31+31+30)*86400)
            $mt="Oct"
            $m=10
            $tmrest=$tmrest-(31+28+$leap+31+30+31+30+31+31+30)*86400
            $dy=int($tmrest/86400)
            $tmrest=$tmrest-$dy*86400
         else
            if($tmrest>(31+28+$leap+31+30+31+30+31+31)*86400)
               $mt="Sept"
               $m=9
               $tmrest=$tmrest-(31+28+$leap+31+30+31+30+31+31)*86400
               $dy=int($tmrest/86400)
               $tmrest=$tmrest-$dy*86400
            else
               if($tmrest>(31+28+$leap+31+30+31+30+31)*86400)
                  $mt="Aug"
                  $m=8
                  $tmrest=$tmrest-(31+28+$leap+31+30+31+30+31)*86400
                  $dy=int($tmrest/86400)
                  $tmrest=$tmrest-$dy*86400
               else
                  if($tmrest>(31+28+$leap+31+30+31+30)*86400)
                     $mt="Jul"
                     $m=7
                     $tmrest=$tmrest-(31+28+$leap+31+30+31+30)*86400
                     $dy=int($tmrest/86400)
                     $tmrest=$tmrest-$dy*86400
                  else
                     if($tmrest>(31+28+$leap+31+30+31)*86400)
                        $mt="Jun"
                        $m=6
                        $tmrest=$tmrest-(31+28+$leap+31+30+31)*86400
                        $dy=int($tmrest/86400)
                        $tmrest=$tmrest-$dy*86400
                     else
                        if($tmrest>(31+28+$leap+31+30)*86400)
                           $mt="May"
                           $m=5
                           $tmrest=$tmrest-(31+28+$leap+31+30)*86400
                           $dy=int($tmrest/86400)
                           $tmrest=$tmrest-$dy*86400
                        else
                           if($tmrest>(31+28+$leap+31)*86400)
                              $mt="Apr"
                              $m=4
                              $tmrest=$tmrest-(31+28+$leap+31)*86400
                              $dy=int($tmrest/86400)
                              $tmrest=$tmrest-$dy*86400
                           else
                              if($tmrest>(31+28+$leap)*86400)
                                 $mt="Mar"
                                 $m=3
                                 $tmrest=$tmrest-(31+28+$leap)*86400
                                 $dy=int($tmrest/86400)
                                 $tmrest=$tmrest-$dy*86400
                              else
                                 if($tmrest>31*86400)
                                    $mt="Feb"
                                    $m=2
                                    $tmrest=$tmrest-31*86400
                                    $dy=int($tmrest/86400)
                                    $tmrest=$tmrest-$dy*86400
                                 else
                                    $mt="Jan"
                                    $m=1
                                    $dy=int($tmrest/86400)
                                    $tmrest=$tmrest-$dy*86400
                                 end_if
                                 
                              end_if
                              
                           end_if
                           
                        end_if
                        
                     end_if
                     
                  end_if
                  
               end_if
               
            end_if
            
         end_if
         
      end_if
      
   end_if
   
   $yr=$yr+1970
   if((int($yr/4)=$yr/4)&((int($yr/100)!$yr/100)|(int($yr/400)=$yr/400)))
      //print($yr," is leap year!")
      $leap=1
   else
      //print($yr," is NOT leap one!")
      $leap=0
   end_if
   if(($m>2)&($leap=1))
      //$dy=$dy+1
      //print("1")
   else
      if(($m=2)&($leap=1))
         $dy=$dy+1
         //print("2")
      else
         //$dy=$dy+1
         if($leap=1)
            //print("31")
            $dy=$dy+1
         else
            //print("32")
            $dy=$dy+1
            //         if($m<2)
            //				    print("32+")
            //				 end_if
         end_if
      end_if
   end_if
   if(($m>2)&($leap=0))
      //$dy=$dy+1
      //print("11")
   else
      if(($m=2)&($leap=0))
         //$dy=$dy+1
         //print("22")
         if($dy=29)
            //print("22+")
            $dy=1
            $m=3
            $mt="Mar"
         end_if
      else
         //$dy=$dy+1
         //print("33")
      end_if
   end_if
   
   $hr=int($tmrest/3600)
   $tmrest=$tmrest-$hr*3600
   $min=int($tmrest/60)
   $tmrest=$tmrest-$min*60
   $sec=$tmrest
   $tmrest=$tmrest-$tmrest
   
   if(strlen($hr)=1)
      $hr=strconcat("0",$hr)
   end_if
   if(strlen($min)=1)
      $min=strconcat("0",$min)
   end_if
   if(strlen($sec)=1)
      $sec=strconcat("0",$sec)
   end_if
   if(strlen($m)=1)
      $m=strconcat("0",$m)
   end_if
   if(strlen($dy)=1)
      $dy=strconcat("0",$dy)
   end_if
   //print(" Year ",$yr,", ",$mt," ",$dy,"th, ",$hr,":",$min,":",$sec," ")
   print(" ",$hr,":",$min,":",$sec," ",$dy,".",$m,".",$yr," r. ")
   $dttime=strconcat(" ",$hr,":",$min,":",$sec," ",$dy,".",$m,".",$yr," r. ")
   //print("+")
end_sub

//halt

Hope that forum's parser won't break the script.