Have a big number (or hex value) you found and think might be a timestamp? Drop it in `unfurl` in the terminal and see what comes out!
(add -d or --detailed if you want the type of timestamp, or run without it if you just want the value)
#DFIR #BF4SA #Unfurl 
R