2

From my research, exFAT has a 2-second resolution for the last modified date/time of files. Also, there is another field for the file storing the offset to the last modified date/time with a 10-millisecond resolution. Am I correct about this?

When I display file properties in Windows Explorer, or use QFileInfo::lastModified() (from the Qt framework) to analyze the file, both methods only display the last modified date/time down to a 2-second resolution.

If I am correct about the above, how do I access the more precise timestamp using Qt, or the Win32 API, or Windows Explorer?

Remy Lebeau
  • 555,201
  • 31
  • 458
  • 770
riverofwind
  • 525
  • 4
  • 17
  • "*Am I correct about this?*" - not quite. The 2nd field you refer to is not an **offset** to a separate date/time timestamp. It is just additional milliseconds that are added to the 2-second timestamp to give it more precision. Together, these 2 fields form a single date/time timestamp, expressed in local time. There is a **3rd** field which *IS* an offset, containing a UTC offset, which is added to the local timestamp to create a date/time timestamp in UTC. – Remy Lebeau Feb 10 '22 at 21:47
  • Thanks Remy. Any idea how to access this more precise timestamp using Qt or the Win API? – riverofwind Feb 10 '22 at 21:52
  • And how come Windows Explorer doesn't show it? In my testing all the timestamps were even seconds. – riverofwind Feb 10 '22 at 22:02
  • "*how come Windows Explorer doesn't show [this more precise timestamp]?*" - did you verify that the 10ms fields are not simply 0 to begin with? – Remy Lebeau Feb 10 '22 at 22:10
  • 1
    I just created 12 new files on the exFAT drive and all of them had even second last modified timestamps. Also when I use QFileInfo::lastmodified and convert it to msecs it's always divisible by 2000 msecs. – riverofwind Feb 10 '22 at 23:25
  • That is not what I asked. Did you verify *in the exFAT metadata itself* whether the 10ms increments are zero vs non-zero? Not what the OS or Qt is giving you, but what exFAT itself is reporting. I'm sure you can find a tool that is able to read and display the raw exFAT data directly (I'm not aware of any Win32 API to get this info without reading the filesystem manually). – Remy Lebeau Feb 11 '22 at 00:12
  • I *suspect* (but can't find) that `QFileInfo` is likely using either `GetFileTimes()` or `GetFileAttributesEx()` to get the timestamp, so it would be at the mercy of whatever Windows decides to report. And it sounds like Windows is not handling the full timestamp precision that is possible with exFAT. – Remy Lebeau Feb 11 '22 at 00:13
  • I just verified with custom GetFileTime() code that the Win API is reading the modified timestamp to 2 seconds resolution for exFAT. – riverofwind Feb 12 '22 at 00:56
  • Nirsoft's Property System View reports 2 second resolution as well. – riverofwind Feb 12 '22 at 01:11
  • Broke out my Ubuntu virtual machine and sure enough it has 10 ms resolution. Windows schmindos – riverofwind Feb 12 '22 at 04:46
  • Last evolution of this thread... I used wmic in Windows to get the modified timestamp of 12 files created in Ubuntu and 12 in Windows. The Ubuntu ones were resolution down to 10 ms while the Windows ones were resolution down to 2 seconds. – riverofwind Feb 12 '22 at 20:53

2 Answers2

0

According to FAT32 and exFAT, which file timestamps are supported?:

Timestamp granularity of 10 ms for Create and Modified times (down from 2 s of FAT, but not as fine as NTFS's 100 ns)

Timestamp granularity for Last Access time to double seconds (FAT had date only).

Do you HAVE to use lastModified? Does Qt expose two other fields?

Note: that "double seconds" granularity matches your observed "divisible by 2000 msecs"

Remy Lebeau
  • 555,201
  • 31
  • 458
  • 770
Vlad Feinstein
  • 10,960
  • 1
  • 12
  • 27
0

Here's the response from a Microsoft rep for what it's worth.

riverofwind
  • 525
  • 4
  • 17