{"id":3360,"date":"2015-11-05T18:13:20","date_gmt":"2015-11-05T18:13:20","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3360"},"modified":"2015-11-06T05:54:24","modified_gmt":"2015-11-06T05:54:24","slug":"java-and-oracle_jre_usage-folder","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/11\/05\/java-and-oracle_jre_usage-folder\/","title":{"rendered":"Java and .oracle_jre_usage folder"},"content":{"rendered":"<p>Today I installed the latest version of Java SDK (8.0.660.17) for testing purposes. After the installation on the good ol&#8217; XP I noticed that it created a folder named %userprofile%\\.oracle_jre_usage. This looked interesting so I googled for it. Turns out lots of people spotted it in earlier version of Java and someone on Oracle forum even provides a good explanation as to what Java component it is from:<\/p>\n<p style=\"padding-left: 30px;\">That is the default location for the Java Usage Tracker. See the Oracle docs<br \/>\n<a href=\"https:\/\/docs.oracle.com\/javacomponents\/usage-tracker\/overview\/\">https:\/\/docs.oracle.com\/javacomponents\/usage-tracker\/overview\/<\/a><\/p>\n<p>Since the folder is created even if the Usage tracker is disabled, we can leverage it as a yet-another-minor timeline-related artifact that can be potentially useful for cherry-picking two Java-related timestamps:<\/p>\n<ul>\n<li>when Java was installed (more or less, see below)<\/li>\n<li>when was the last time java.exe was launched (most likely to execute an application; I have not tested JRE &amp; applets yet)<\/li>\n<\/ul>\n<p>The folder &#8216;%userprofile%\\.oracle_jre_usage&#8217; is created during Java installation:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle0.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3362\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle0-300x192.png\" alt=\"oracle0\" width=\"300\" height=\"192\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle0-300x192.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle0-80x50.png 80w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle0.png 823w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>so you should find at least one randomly named file in this folder. In my case it was:<\/p>\n<ul>\n<li>90737d32e3aba4b.timestamp<\/li>\n<\/ul>\n<p>Inspecting its content shows a path leading to Java JRE and a timestamp in a format that appears to be a Unix timestamp with microseconds:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3361\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle1-300x74.png\" alt=\"oracle1\" width=\"300\" height=\"74\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle1-300x74.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle1.png 558w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>gives us 1446745410996 which roughly translates to 2015-10-05 09:43:30:996\u00a0 &#8211; somewhere in-between the logs shown in Procmon output (could be a discrepancy between the time of retrieving of the timestamp and time of actually writing it to a file).<\/p>\n<p>Running actual Java program causes the java.exe to look for &#8216;f9b9f6b8ff8b2b60.timestamp&#8217; (refer to Procmon screenshot above) &#8211; this is randomly named file as well so if you look at the folder, you should see 2 of them.<\/p>\n<p>If not found it&#8217;s created and its content is similar to &#8216;90737d32e3aba4b.timestamp&#8217;: the path and the Unix stamp.<\/p>\n<p>The following screenshot shows how the Unix timestamp is changing anytime we run java.exe to execute a simple HelloWorld Java application (HelloWorld.class):<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3363\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle2-300x152.png\" alt=\"oracle2\" width=\"300\" height=\"152\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle2-300x152.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/11\/oracle2.png 669w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>To conclude: nothing ground breaking, but yet another pair of timestamps that may help with the investigation one day&#8230;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today I installed the latest version of Java SDK (8.0.660.17) for testing purposes. After the installation on the good ol&#8217; XP I noticed that it created a folder named %userprofile%\\.oracle_jre_usage. This looked interesting so I googled for it. Turns out &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/11\/05\/java-and-oracle_jre_usage-folder\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[19],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3360"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3360"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3360\/revisions"}],"predecessor-version":[{"id":3368,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3360\/revisions\/3368"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}