{"id":93715,"date":"2016-06-21T07:00:00","date_gmt":"2016-06-21T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=93715"},"modified":"2019-03-13T11:51:15","modified_gmt":"2019-03-13T18:51:15","slug":"20160621-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20160621-00\/?p=93715","title":{"rendered":"How to recognize DNS zone scavenging availability timestamps from quite a long way away"},"content":{"rendered":"<p>A customer couldn&#8217;t figure out how to decipher the <i>scavenge available<\/i> value that is <a HREF=\"https:\/\/support.microsoft.com\/en-us\/kb\/2791165\">produced by the <code>dnscmd \/zoneinfo<\/code> command<\/a>: <\/p>\n<pre>\nC:\\&gt; dnscmd \/zoneinfo contoso.com\nZone query result:\nZone info:\n    ptr                     = 0000000000327C90\n    zone name               = contoso.com\n    zone type               = 1\n    update                  = 2\n    DS integrated           = 1\n    data file               = (null)\n    using WINS              = 0\n    using Nbstat            = 0\n    aging                   = 1\n        refresh interval    = 168\n        no refresh          = 168\n        <span STYLE=\"border: solid 1px black\">scavenge available  = 3606130<\/span>\n    ...\n<\/pre>\n<p>(If you want to see what it looks like in French, <a HREF=\"http:\/\/blogs.technet.com\/b\/windows_networking_fr\/archive\/2011\/07\/27\/comment-auditer-la-suppression-d-enregistrements-dns-dans-une-zone-int-233-gr-233-e-active-directory.aspx\">here ya go<\/a>.) <\/p>\n<p>The customer liaison found <a HREF=\"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=42653\">an old article of mine on decoding timestamps<\/a> but none of the tricks on that page worked. <\/p>\n<p>So what is the format for the <i>scavenge available<\/i> time? <\/p>\n<p>This is one of those weird custom time formats. Specifically, it is &#8220;Hours since January 1, 1601 UTC&#8221;. <\/p>\n<p>The <code>FILETIME<\/code> format has the same epoch, so the easiest conversion is to convert it through a <code>FILETIME<\/code>. <\/p>\n<pre>\nusing System;\n\nclass Program\n{\n    public static void Main()\n    {\n        var x = 3606130;\n        var y = DateTimeOffset.FromFileTime(x * 36000000000);\n        System.Console.WriteLine(\"{0:u}\", y);\n    }\n}\n<\/pre>\n<p>This program prints <code>2012-05-21 10:00:00Z<\/code>, which is the scavenge time. <\/p>\n<p><b>Bonus reading<\/b>: <a HREF=\"https:\/\/blogs.technet.microsoft.com\/networking\/2008\/03\/19\/dont-be-afraid-of-dns-scavenging-just-be-patient\/\">Don&#8217;t be afraid of DNS scavenging. Just be patient<\/a>. <\/p>\n<p><i>Earlier versions of this article said that the starting point was January 1, 1600 UTC. This has been corrected.<\/i> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>A rather peculiar format.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[104],"class_list":["post-93715","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-tipssupport"],"acf":[],"blog_post_summary":"<p>A rather peculiar format.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/93715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=93715"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/93715\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=93715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=93715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=93715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}