Unix Time conversion with powershell

Question

Import-Module SQLite
mount-sqlite -name places -data (resolve-path C:\Users\malware_win7x86\Desktop\places.sqlite)
$places = Get-ChildItem places:\moz_places

foreach ($entry in $places)
{
    [datetime]$origin = '1970-01-01 00:00:00'
    $visited = $entry.last_visit_date

    if ($visited) {
        $vtime = $origin.AddSeconds($visited)
    } else {
        $vtime = 'testing'
    }

    write-host ""
    $entry.url,
    $entry.visit_count,
    $vtime
}

Reference: Convert Unix time with PowerShell

I'm curious on how to handle entries with no data.

For example, here is some output from that script:

http://sysforensics.org/
1
Exception calling "AddSeconds" with "1" argument(s): "Value to add was out of range.
Parameter name: value"
At line:7 char:28
+ $vtime = $origin.AddSeconds <<<< ($visited)
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

Any ideas on this?

Thanks

Answer 1

That error looks like you're giving AddSeconds an argument that is either too big or too small, rather than missing data. Calling AddSeconds with either $null or 0 will return the original date unchanged.

That being said—and I can't be sure, since you haven't provided the actual integer that you're trying to convert—I had the same problem until I realized that the data I was receiving was in milliseconds, not seconds. You can either use AddMilliseconds instead, or divide the number by 1000 before using AddSeconds if you don't care about the loss of precision.

Credit to this answer for pointing me in the right direction.

Answer 2

In that case you'd just skip the method call and substitute a default value, e.g.:

if ($visited) { # or maybe $ivisited -is [int] or whatever your criterion is
  $vtime = $origin.AddSeconds($visited)
} else {
  $vtime = $null
}