Windows Filetime

Hey all,

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Thanks

Stuart C. wrote:

I have done some Googling and have yet to find a solution to a problem I
have. I am trying to decode a Windows filetime value e.g. LoTime,HiTime.
These values are commonly found in the registry and I have yet to find a
library in Ruby to deal with them and convert them to a valid date?

Any suggestions?

Google “ruby windows timestamp” (without the quotes)

The first hit is code.

The third google hit contains this link:
http://msdn.microsoft.com/en-us/library/ms724284(VS.85).aspx

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

“site:www.ruby-forum.com active directory timestamp”

The first hit is code.

The third google hit contains this link:
http://msdn.microsoft.com/en-us/library/ms724284(VS.85).aspx

Combine the two 32-bit values to get a 64-bit value which is the number
of tenths of a microsecond since 1 Jan 1601.

Google also:

“site:www.ruby-forum.com active directory timestamp”

Thanks, I had the documentation, but the ruby link is new on me. Thanks
a lot.

On Sep 17, 10:19 am, Brian C. [email protected] wrote:

The first hit is code.
Posted viahttp://www.ruby-forum.com/.
It looks like Win32::Registry.wtime2time() (http://ruby-doc.org/stdlib/
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

Stuart C. wrote:

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the exact exception message
you saw.

Chris H. wrote:

On Sep 17, 10:19�am, Brian C. [email protected] wrote:

The first hit is code.
Posted viahttp://www.ruby-forum.com/.
It looks like Win32::Registry.wtime2time() (http://ruby-doc.org/stdlib/
libdoc/Win32API/rdoc/classes/Win32/Registry.html#M001570)
might do the trick.

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

When I try the following however it works:

require ‘date’

highpart = 29513297
lowpart = 1857145088
intLogonTime = highpart * (2**32) + lowpart
intLogonFloat = intLogonTime.to_f / (60 * 10000000 * 1440).to_f
last_logon = intLogonFloat

base = DateTime.new(1601,1,1,0,0,0)
base += intLogonFloat

p base.to_s

Any ideas?

Brian C. wrote:

Stuart C. wrote:

I have just tried this and I get a big num error. See an example below:

puts Win32::Registry.wtime2time(185714508829513297)

To be a useful error report, you must post the exact exception message
you saw.

Apologies, I meant to copy it in. Please see below.

C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in at': bignum too big to convert intolong’ (RangeError)
from C:/Ruby191/lib/ruby/1.9.1/win32/registry.rb:515:in wtime2time' from test.rb:3:in

Sorry again, my bad. Thanks in advance.

This forum is not affiliated to the Ruby language, Ruby on Rails framework, nor any Ruby applications discussed here.

| Privacy Policy | Terms of Service | Remote Ruby Jobs