Share:
Glossary Forensics

Compile timestamp

The compile timestamp is a date stored in a Windows executable's header, in seconds since 1970, recording when it was linked.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

It can hint at when a sample was built, but it is trivial to forge, and many modern builds set it to zero or a hash for reproducibility. Treat it as a clue to cross-check against other evidence, not as proof. See Unix timestamp and Timestomping.

Try these tools

Executable Forensics

Inspect Windows PE, Linux ELF and macOS Mach-O executables in your browser - headers, sections with per-section entropy, imports/exports.

See also

  • Glossary Unix timestamp
    A Unix timestamp is the number of seconds since 00:00:00 UTC on 1 January 1970, the "Unix epoch".
  • Glossary Timestomping
    Timestomping is deliberately changing a file's timestamps to hide when it was created or modified.
  • Glossary Portable Executable (PE) file
    The Portable Executable format is the structure of Windows programs and libraries (.exe, .dll, .sys).
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard