3

I've been writing a small library to allow parsing of the data files used by Sage Accounts 50, but I'm really confused by how it is storing dates.

I'm fairly sure that there will be a date created and date modified.

This should contain a modified date of 05/01/2014

01 00 00 00 01 00 00 27 00 00 00 65 87 A9 CB 80 55 E4 40 EA 7D BC E5 1B 55 E4 40 65 87 A9 CB 80 55 E4 40 00

12/02/2014:

01 00 00 00 01 00 00 29 00 00 00 72 11 06 D0 81 55 E4 40 EA 7D BC E5 1B 55 E4 40 72 11 06 D0 81 55 E4 40 00

16/06/2014:

01 00 00 00 01 00 00 2B 00 00 00 6A F8 DB D4 81 55 E4 40 EA 7D BC E5 1B 55 E4 40 6A F8 DB D4 81 55 E4 40 00

12/12/2013:

01 00 00 00 01 00 00 2D 00 00 00 F8 F1 96 E6 81 55 E4 40 EA 7D BC E5 1B 55 E4 40 F8 F1 96 E6 81 55 E4 40 00

Any help would be really appreciated. I've already tried looking for unix time stamps and also struct tm, without any luck.

Thanks

EDIT

As requested here are some dates which are more sequential:

01/12/13 - 01 00 00 00 01 00 00 2F 00 00 00 7C E8 A9 80 94 55 E4 40 EA 7D BC E5 1B 55 E4 40 7C E8 A9 80 94 55 E4 40 00
02/12/13 - 01 00 00 00 01 00 00 31 00 00 00 81 59 DC 89 94 55 E4 40 EA 7D BC E5 1B 55 E4 40 81 59 DC 89 94 55 E4 40 00
03/12/13 - 01 00 00 00 01 00 00 33 00 00 00 BF 58 F2 8B 94 55 E4 40 EA 7D BC E5 1B 55 E4 40 BF 58 F2 8B 94 55 E4 40 00
5
  • Can you post several dates which are going one after another?
    – PhoeniX
    Commented Jan 5, 2014 at 14:54
  • Could it be your samples contain 3 dates?
    – Jongware
    Commented Jan 5, 2014 at 15:47
  • @Jongware if they do, i cannot find them Commented Jan 5, 2014 at 15:52
  • Aaron, I meant that you are "fairly sure" it contains 2 dates. Based on the data repetitions, I count 3.
    – Jongware
    Commented Jan 5, 2014 at 16:03
  • Alas -- all 8-byte sequences ending with 40 could have been doubles, but then "05/01/2014" would be less than "03/12/13" (41644.0249 vs. 41644.642). So that makes no sense.
    – Jongware
    Commented Jan 5, 2014 at 16:32

1 Answer 1

8

These are 64-bit OLE date format, but they are not the dates you're thinking they are. I took all of your samples and sorted them into the order you posted them (from top to bottom). I then decoded the 8-byte strings starting from byte 11 of each sample as a double in IEEE format and then dumped the floating-point number in text form. (I wrote a quick C++ program, but one could do that with many other methods.) I then put those into a spreadsheet (I used Libre Office, but one could also use Excel) to interpret them as Microsoft's 64-bit OLE date formats which are number of seconds from 30 December 1899 0:00:00 and got the following (mm/dd/yyyy format):

01/05/2014 00:35:48 41644.02486
01/05/2014 01:21:34 41644.05664
01/05/2014 01:22:25 41644.05723
01/05/2014 01:25:32 41644.0594
01/05/2014 15:22:37 41644.64071
01/05/2014 15:24:14 41644.64183
01/05/2014 15:24:36 41644.64208

It looks like the last three samples were sequentially created within two minutes, which makes sense to me. So they are indeed dates, but not the ones you think they are. Look elsewhere for changes in the file for 8-byte sequences ending with 0x40.

1
  • Wow, that's great. Thank you so much. I did come across the OLE date format but I really was not sure how to use it. I'll try and focus my attention on that then. Thanks! Really appreciate your help. Commented Jan 5, 2014 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.