Skip to content
MessagingFORENSICS

Glossary

FILETIME (Windows timestamp)

Windows FILETIME is a 64-bit count of 100-nanosecond intervals since 1601-01-01 00:00:00 UTC, used in NTFS, the registry and Outlook MSG properties.

Definition

FILETIME is the Windows structure for timestamps: an unsigned 64-bit integer counting 100-nanosecond intervals (ticks) since 1601-01-01 00:00:00 UTC, the start of the Gregorian 400-year cycle in which Windows NT was designed. It is stored little-endian as two 32-bit halves, dwLowDateTime and dwHighDateTime.

Where you meet it

  • NTFS $MFT timestamps, registry key last-write times, LNK files and prefetch.
  • MAPI properties of type PT_SYSTIME in Outlook .msg files, such as PR_CLIENT_SUBMIT_TIME (0x0039) and PR_MESSAGE_DELIVERY_TIME (0x0E06). Teams chat messages exported from Microsoft Purview eDiscovery as .msg items carry their times this way.
  • PST and OST internals.

Conversion

There are 11,644,473,600 seconds between 1601-01-01 and 1970-01-01:

unix_seconds = filetime / 10000000 - 11644473600

Example: 133512561000000000 is 2024-02-01 10:15:00 UTC.

Pitfalls

A FILETIME exceeds the range JavaScript and many spreadsheets represent exactly as a double, so parse it as a 64-bit integer (BigInt) before dividing. Values are UTC by definition; any local time shown by a viewer is a display conversion. A zero value means "not set", not 1601.