Showing NTFS timestamp with 100 nsec granularity

Question

I understand that the FAT file system stores its time stamps for files (modify date, etc.) with a 2 second granularity, and NTFS stores them with a 100 nsec granularity.

I'm using VBScript with FileSystemObject to show file details. The function file.DateLastModified shows me the date with a 1 second precision (on NTFS).

Is there a way to show the time stamps with a precision according to the internal storage granularity of NTFS. I'm imagining something like 8/9/2010 14:40:30,1234567

And if not with VBScript / FileSystemObject, would there be any other way?

patthoyts · Accepted Answer · 2011-03-03T14:47:37.197

9

File timestamps are held as FILETIME in NTFS but the millisecond portion is not passed to the Variant DateTime so VBS doesn't see it. The WMI object can support this though.

Sub PrintTimestamp(sFilename)
  Set oWMI = GetObject("winmgmts:!\\.\root\cimv2")
  Set oFiles = oWMI.ExecQuery("Select * from CIM_DataFile where Name = '" & sFilename & "'")
  Set oDateTime = CreateObject("WbemScripting.SWbemDateTime")
  For Each oFile in oFiles
    oDateTime.Value = oFile.LastAccessed
    WScript.Echo oFile.Name & " " & oDateTime.GetVarDate & " " & oDateTime.Microseconds
  Next
End Sub
PrintTimestamp("c:\\temp\\demo.vbs")

edited Mar 03 '11 at 14:47

answered Mar 03 '11 at 13:32

patthoyts

32,320
3
62
93

It took me a while to figure out why I got an error at first. Turns out that you have to supply the file path with double back-slashes, like c:\\temp\\file.txt. Then it works. – mgr326639 Mar 03 '11 at 14:37
2

The function `oDateTime.Microseconds` will give me a granularity of up to a microsecond. One factor of 10 missing there to get to 100 nanoseconds. But your answer has solved my problem anyway. – mgr326639 Mar 03 '11 at 22:50

score 0 · Answer 2 · answered Mar 03 '11 at 13:23

Full-precision file times are easily accessible via the native Windows API. This MSDN article explains how to do it: File Times.

I do not know of any way to read the 64-bit FILETIME from VBS, especially since VBS does not handle 64-bit numbers natively. Once you have a FILETIME you can parse it with SWbemDateTime, though. Here is an example.

Showing NTFS timestamp with 100 nsec granularity

2 Answers2