windows_registry_hex_to_datetime.py

def decode_date_last_connected(hex_string):
    # Convert hex to bytes
    bytes_array = bytes.fromhex(hex_string)
    
    # Swap every 2-byte chunk to convert from little endian to big endian
    swapped_bytes = bytearray()
    for i in range(0, len(bytes_array), 2):
        swapped_bytes.extend(bytes_array[i:i+2][::-1])
    
    # Convert each chunk from bytes to integer
    year = int.from_bytes(swapped_bytes[0:2], 'big')
    month = int.from_bytes(swapped_bytes[2:4], 'big')
    day_of_week = int.from_bytes(swapped_bytes[4:6], 'big')  # Not used in datetime
    day = int.from_bytes(swapped_bytes[6:8], 'big')
    hour = int.from_bytes(swapped_bytes[8:10], 'big')
    minute = int.from_bytes(swapped_bytes[10:12], 'big')
    second = int.from_bytes(swapped_bytes[12:14], 'big')
    millisecond = int.from_bytes(swapped_bytes[14:16], 'big')
    
    return datetime.datetime(year, month, day, hour, minute, second, millisecond * 1000)

# Given hex string
date_last_connected_hex = "e8070500020015001400300011003a03"

# Decode the date
decoded_date = decode_date_last_connected(date_last_connected_hex)
decoded_date