Skip to content

Glossary

FILETIME

Windows 64-bit timestamp counting 100-nanosecond intervals since 1 January 1601 UTC, used for the dates stored in the Windows Search index.

A FILETIME is a 64-bit integer counting 100-nanosecond intervals since 00:00 UTC on 1 January 1601. Windows uses it for file system timestamps, registry key times and most artefacts, including the dates in the Windows Search index: System.DateCreated, System.DateModified, System.DateAccessed and System.Search.GatherTime.

FILETIMEs are UTC by definition, so any local-time display is a conversion by the tool. In Windows.db they are stored as 8-byte values whose byte order a parser must get right; a wrong order yields absurd dates. See Windows Search index properties explained.