Windows Filetime

[Stuart Clarke]

Hey all,

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Thanks

 

[Brian Candler]

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Google "ruby windows timestamp" (without the quotes)

The first hit is code.

The third google hit contains this link:
http://msdn.microsoft.com/en-us/library/ms724284(VS.85).aspx

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

"site:www.ruby-forum.com active directory timestamp"

 

[Chris Hulan]

Google "ruby windows timestamp" (without the quotes)

The first hit is code.

The third google hit contains this link:http://msdn.microsoft.com/en-us/library/ms724284(VS.85).aspx

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

"site:www.ruby-forum.comactive directory timestamp"

It looks like Win32::Registry.wtime2time() (http://ruby-doc.org/stdlib/
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

 

[Stuart Clarke]

The first hit is code.

The third google hit contains this link:
http://msdn.microsoft.com/en-us/library/ms724284(VS.85).aspx

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

"site:www.ruby-forum.com active directory timestamp"

Thanks, I had the documentation, but the ruby link is new on me. Thanks
a lot.

 

[Stuart Clarke]

It looks like Win32::Registry.wtime2time() (http://ruby-doc.org/stdlib/
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

When I try the following however it works:

require 'date'

highpart = 29513297
lowpart = 1857145088
intLogonTime = highpart * (2**32) + lowpart
intLogonFloat = intLogonTime.to_f / (60 * 10000000 * 1440).to_f
last_logon = intLogonFloat

base = DateTime.new(1601,1,1,0,0,0)
base += intLogonFloat

p base.to_s

Any ideas?

 

[Brian Candler]

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the *exact* exception message
you saw.

 

[Stuart Clarke]

To be a useful error report, you must post the *exact* exception message
you saw.

Apologies, I meant to copy it in. Please see below.

C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in `at': bignum too big
to convert into `long' (RangeError)
from C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in `wtime2time'
from test.rb:3:in `<main>'

Sorry again, my bad. Thanks in advance.