decoding a Skype timestamp

From a Skype group chat I needed to recover the time it was held. Unfortunately there is no easy way to access the group chat log from Skype.

identify the Skype log file

In the steps below, replace "skypename" by your skype login name, and "messagetext" by some (fairly unique) message text you remember from the chat.

• cd ~/.Skype/skypename
• grep -i messagetext *
• Let's assume grep tells you:
  Binary file chatmsg256.dbb matches

identify the location of the message in the log file

• open the message file in a hex viewer. You can use the viewer in Midnight Commander for this, for example (press F3 to view the file)
• find the relevant message (in midnight commander, press F7)
• make sure you can also see the file's bytes in hex (in midnight commander, press F4)
• look for the bytes E5 03 after the message text
• write down the five bytes that follow E5 03, for example 9C 9C 9B BE 04

decode the timestamp

For whatever reason, the message timestamp is the standard Linux time() timestamp (number of seconds since Jan. 1, 1970), but stored in 5 bytes in a strange way.
To decode:

• write down the bytes you got in reverse order:
  04 BE 9B 9C 9C
• write out this number in binary, and then remove (1) the 4 most significant bits of the first byte, and (2) the single most significant bit of the 2nd-4th bytes. In our running example: 0000 0100 - 1011 1110 - 1001 1011 - 1001 1100 - 1001 1100 xxxx x x x x gives: 0100 011 1110 001 1011 001 1100 001 1100
• convert the resulting 4 byte number back to an integer, and convert that to an actual timestamp, using localtime(time) for example

Coming up: a program to do this last decoding step for you, given the 5 bytes found in the message log.

For the record: this tip last modified March 24, 2008. Tested using Skype 1.3.0.53 under Fedora 8.