Windows FILETIME - Revision history

Jsummers at 13:39, 26 August 2017

2017-08-26T13:39:00Z

Jsummers: Category:Date and time formats

2017-07-23T15:01:26Z

Category:Date and time formats

Jsummers at 17:14, 19 July 2017

2017-07-19T17:14:15Z

Jsummers: Created page with "{{FormatInfo |formattype=electronic |subcat=Elements of File Formats }} '''Windows FILETIME''' is a timestamp format associated with Microsoft Windows, and with NTFS. It a..."

2017-07-19T16:50:28Z

Created page with "{{FormatInfo |formattype=electronic |subcat=Elements of File Formats }} '''Windows FILETIME''' is a timestamp format associated with Microsoft Windows, and with NTFS. It a..."

New page

{{FormatInfo
|formattype=electronic
|subcat=Elements of File Formats
}}
'''Windows FILETIME''' is a timestamp format associated with Microsoft Windows, and with [[NTFS]]. It appears in some file formats, for example [[Microsoft Compound File]].

It is a 64-bit integer representing the number of 100-nanosecond intervals since the beginning of the year 1601, UTC (ignoring leap seconds).

Because the traditional Windows API did not use 64-bit integers, it is often represented as a structure (named "FILETIME", of course) containing two 32-bit integers.

Despite its name, it is often used for things other than timestamps of files.

== Links ==
* [https://msdn.microsoft.com/en-us/library/windows/desktop/ms724290(v=vs.85).aspx Windows Dev Center: File Times]
* [https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx Windows Dev Center: FILETIME structure]
* [https://articles.forensicfocus.com/2013/04/06/interpretation-of-ntfs-timestamps/ Forensic Focus: Interpretation of NTFS Timestamps]

[[Category:Microsoft]]
[[Category:Windows]]

← Older revision		Revision as of 13:39, 26 August 2017
Line 10:		Line 10:

	Despite its name, it is often used for things other than timestamps of files.		Despite its name, it is often used for things other than timestamps of files.
		+
		+	== See also ==
		+	* [[Windows SYSTEMTIME]]

	== Links ==		== Links ==

@@ Line 16: / Line 16: @@
 * [https://articles.forensicfocus.com/2013/04/06/interpretation-of-ntfs-timestamps/ Forensic Focus: Interpretation of NTFS Timestamps]
 [[Category:Microsoft]]
 [[Category:Windows]]

@@ Line 5: / Line 5: @@
 '''Windows FILETIME''' is a timestamp format associated with Microsoft Windows, and with [[NTFS]]. It appears in some file formats, for example [[Microsoft Compound File]].
-It is a 64-bit integer representing the number of 100-nanosecond intervals since the beginning of the year 1601, UTC (ignoring leap seconds).
+It is a 64-bit integer representing the number of 100-nanosecond intervals since the beginning of the year 1601, UTC (ignoring leap seconds). Evidence suggests that the high bit is reserved, and the other 63 bits represent an unsigned integer. This means it can represent dates from about the years 1601 to 30828.
 Because the traditional Windows API did not use 64-bit integers, it is often represented as a structure (named "FILETIME", of course) containing two 32-bit integers.