Re: [ros-dev] [ros-diffs] [pschweitzer] 64752: [NTFS] Implement NtfsDateTimeToFileTime() which convert epoch time (1970) to Windows time (1601)

[Thomas Faber]

On 2014-10-15 22:23, [e-mail] wrote:
> +/* See:
> -> http://msdn.microsoft.com/en-us/library/ms724228
> -> http://bos.asmhackers.net/docs/filesystems/ntfs/standard.html#layout
> */
>
> +VOID
> +NtfsDateTimeToFileTime(ULONGLONG NtfsTime,
>                   PLARGE_INTEGER SystemTime)
>
> +{
> SystemTime->QuadPart = NtfsTime + 116444736000000000;
>
> +}

Doesn't NTFS use FILETIME directly? I thought that's the reason it's
called "file time" in the first place. ;)
Wikipedia says
"Date range: 1 January 1601 – 28 May 60056 (File times are 64-bit
 numbers counting 100-nanosecond intervals (ten million per second)
 since 1601, which is 58,000+ years)"
and your link doesn't seem to disagree.

[Pierre Schweitzer]

My link says: "Values are stored in universal coordinated time, like in
Linux."
This is what I interpret as: stored with epoch, need to shift to 1601.

On 15/10/2014 22:46, Thomas Faber wrote:
> On 2014-10-15 22:23, [e-mail] wrote:
> > +/* See:
> > -> http://msdn.microsoft.com/en-us/library/ms724228
> > -> http://bos.asmhackers.net/docs/filesystems/ntfs/standard.html#layout
> > */
> >
> > +VOID
> > +NtfsDateTimeToFileTime(ULONGLONG NtfsTime,
> >                   PLARGE_INTEGER SystemTime)
> >
> > +{
> > SystemTime->QuadPart = NtfsTime + 116444736000000000;
> >
> > +}
>
> Doesn't NTFS use FILETIME directly? I thought that's the reason it's
> called "file time" in the first place. ;)
> Wikipedia says
> "Date range: 1 January 1601 – 28 May 60056 (File times are 64-bit
>  numbers counting 100-nanosecond intervals (ten million per second)
>  since 1601, which is 58,000+ years)"
> and your link doesn't seem to disagree.
>
> Ros-dev mailing list
> [e-mail]
> http://www.reactos.org/mailman/listinfo/ros-dev
-- 
Pierre Schweitzer <pierre at reactos.org>
System & Network Administrator
Senior Kernel Developer
ReactOS Deutschland e.V.