The results were a ghost town. A few dead forum links. A GitHub repository with a name like a ransom note: zkteco_parser.py . No readme. No stars. Last commit: 2017.
Marcy looked at her screen. The script was still running. File by file. Ghost punches stacking up like a second shift no one ever saw.
She checked another day. Same thing. 3:14 AM. Every Tuesday. Clocking in on a terminal that didn’t exist. zkteco dat file reader
Pause. “They said a ZK Teco device went missing from the vault corridor in 2016. We never reported it.”
User ID: 0042 | Name: J. Carver | Timestamp: 2016-03-14 03:14:00 — three hours before his first punch. The results were a ghost town
Marcy found the raw hex dump. The ZK Teco devices stored user-defined fields. One field was labeled AccessLevel . For J. Carver, it wasn't 1 (Manager) or 2 (Employee).
The Python script was ugly. Hardcoded offsets, magic bytes, and a comment that read: // if this breaks, the fingerprint template changed again. RIP. No readme
She wrote a loop. One file turned into a hundred. The script began stitching together shifts. Absences. Late arrivals. Then—anomalies.
Terminal spit out: User ID: 0042 | Name: J. Carver | Timestamp: 2016-03-14 08:31:47
And in the empty office, two floors above a concrete vault, a silent ZK Teco terminal—unplugged for eight years—briefly blinked its green LED.