NTFS Time Calculator
Windows FILETIME is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since January 1, 1601 UTC (Universal Coordinated Time). It’s commonly found in Windows file systems, event logs, and system APIs to store timestamps with high precision. Each file on a Windows system has several FILETIME values associated with it – creation time, last access time, and last write time. When examining Windows forensic artifacts, log files, or doing system analysis, you’ll often encounter these timestamps in their raw hexadecimal format (like 1db2d1960e1a770). Converting these values to human-readable dates is essential for understanding when events occurred or when files were modified. The format’s start date of 1601 was chosen because that was the start of the Gregorian calendar’s first complete 400-year cycle after the calendar’s adoption in 1582.
