ntfs 时间戳换算

 

ntfs记录的文件时间，在MFT的0x10属性中,存储的是8个byte的时间,这个时间表示的是自1601年1月1日的00:00开始的100ns的计数.

 

 

132,670,139,622,214,003(00) ns = 132,670,139,62 s

 

from dateutil.parser import parse
import time as tm
from datetime import *

var = 0x01D756CA007BC973
time_ntfs = parse('1601-01-01/00:00:00')
time_utc = parse('1970-01-01/00:00:00' )
varstr = var.to_bytes(8,'little',signed=False)
print ( 'HEX:\t%#2x'  %  var  )
print ( 'HEX(lit):\t%#2s'  % bytes.hex(varstr)  )
print (  'int:\t%d' % var  )
offset =  ((time_utc- time_ntfs)).total_seconds() * 10000000
var_file = (var - offset) 
print ( var_file )
print ( datetime.utcfromtimestamp(var_file /10000000 ) )

time_file = parse('2021-06-01/09:39:22.221400' )
print (tm.mktime(time_file.timetuple()))

 

 

 

HEX:	0x1d756ca007bc973
HEX(lit):	73c97b00ca56d701
int:	132670139622214003
1.6225403622214e+16
2021-06-01 09:39:22.221400
1622511562.0