How to recognize DNS zone scavenging availability timestamps from quite a long way away

A customer couldn’t figure out how to decipher the scavenge available value that is produced by the dnscmd /zoneinfo command:

C:\> dnscmd /zoneinfo contoso.com
Zone query result:
Zone info:
    ptr                     = 0000000000327C90
    zone name               = contoso.com
    zone type               = 1
    update                  = 2
    DS integrated           = 1
    data file               = (null)
    using WINS              = 0
    using Nbstat            = 0
    aging                   = 1
        refresh interval    = 168
        no refresh          = 168
        scavenge available  = 3606130
    ...

(If you want to see what it looks like in French, here ya go.)

The customer liaison found an old article of mine on decoding timestamps but none of the tricks on that page worked.

So what is the format for the scavenge available time?

This is one of those weird custom time formats. Specifically, it is “Hours since January 1, 1601 UTC”.

The FILETIME format has the same epoch, so the easiest conversion is to convert it through a FILETIME.

using System;

class Program
{
    public static void Main()
    {
        var x = 3606130;
        var y = DateTimeOffset.FromFileTime(x * 36000000000);
        System.Console.WriteLine("{0:u}", y);
    }
}

This program prints 2012-05-21 10:00:00Z, which is the scavenge time.

Bonus reading: Don’t be afraid of DNS scavenging. Just be patient.

Earlier versions of this article said that the starting point was January 1, 1600 UTC. This has been corrected.