convert 64 bit windows date time in python

Question

I need to convert a windows hex 64 bit (big endian) date time to something readable in python?

example '01cb17701e9c885a'

converts to "Tue, 29 June 2010 09:47:42 UTC"

Any help would be appreciated.

Answer 1

Looks like a Win32 FILETIME value, which:

Contains a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).

To convert:

from datetime import datetime,timedelta
dt = '01cb17701e9c885a'
us = int(dt,16) / 10
print(datetime(1601,1,1) + timedelta(microseconds=us))

Output:

2010-06-29 09:47:42.754210

Answer 2

The value is "the number of 100-nanosecond intervals that have elapsed since 12:00:00 midnight, January 1, 1601", so you are looking for something like:

import datetime

def getFiletime(dt):
    microseconds = int(dt, 16) / 10
    seconds, microseconds = divmod(microseconds, 1000000)
    days, seconds = divmod(seconds, 86400)

    return datetime.datetime(1601, 1, 1) + datetime.timedelta(days, seconds, microseconds)

then

print format(getFiletime('01cb17701e9c885a'), '%a, %d %B %Y %H:%M:%S %Z')

results in

Tue, 29 June 2010 09:47:42

It appears that Python's datetime formatting chokes on years prior to 1900; if you aren't actually dealing with such dates, you should be fine.