FILETIME

FILETIME is the standard way Windows stores a point in time: a 64-bit value counting 100-nanosecond intervals since 1 January 1601 (UTC). In the Win32 API it is exposed as a structure with two 32-bit halves, dwLowDateTime and dwHighDateTime, written to disk in little-endian order.

Investigators meet this format everywhere. NTFS stores its MACB timestamps as FILETIME values in the $MFT, every registry key carries a last write time in the same format, and artifacts such as Prefetch, LNK files and event logs rely on it too. Because the value is anchored to UTC, it needs no time zone correction, unlike the local-time formats described in UTC vs local time.

A few practical points help when reading raw data:

• A zero value usually means "not set", and tools may show it as 1601-01-01.
• The 100-nanosecond resolution is a useful tampering check: timestamps with an all-zero fractional part can indicate timestomping.
• Not every file system keeps that precision. Microsoft documents that FAT stores times in local time with coarse resolution (2 seconds for write time), while NTFS stores UTC.

Most forensic parsers decode these values automatically; when reading raw hex, remember the bytes are little-endian.