🚀 go-pugleaf

On Tue, 06 Apr 2004 10:20:39 -0700, Bob Gonder wrote:

> Hmmm.. if( (DWORDLONG)OldTime == (DWORDLONG)ftCreationTime ) ?

I believe so, yes. Certainly the OS and NTFS store date/times as a single
64 bit integer. It's the number of nanoseconds since the 1.1.1601

> Yep, but it should also take the _date_ into consideration too. Since
> date is part of FILETIME, the info is available, and
> FileTimeToLocalTime should Not add DST to non-DST dates. 

[snip]

I think it's better this way. Right now our computers are suggesting we
were all at work an hour later last week. This is correct. We were. The
times reported on our systems are correctly reflecting the fact that we
have entered BST.

> Talking of forensics.. So if I murder someone at 9am last Friday, get
> to work by 10 to create a computer trail, come Monday when the cops
> see me, my computer dutifully shows my 9am alibi.

Lol. That would only stand up for ten minutes. Trust me :)

I just tried an experiment on my system and it was quite enlightening. One
of the things our tools can do is show a graph of date/times for a group of
files. In one mode it shows the amount of activity (number of files)
against date/time. If I point it at one particular directory which contains
log files you can see the point at which BST kicked in.

> > A program that never used FileTimeToLocal time would
> >not see a difference.
> 
> That's what's confusing.  I don't use anything other than CompareTime.
> 

Very odd then.

> > Modern file systems store their times in UTC, older
> 
> Including Win98, right?  (This is running on a '98se box)

Ye-es. FAT is a sticky issue. As a file system originally it stored
date/times in local time. This is because didn't have any way of dealing
with DST other than getting the user to change the time.

Windows 9x /does/ so a Windows 9x machine will generate date/times that are
UTC.

OTOH if the machine was originally running DOS (or perhaps a version of
Windows prior to 9x) and was upgraded to Windows 9x then there could be a
mixture of UTC and local time.
-- 
Andrue Cope
[Bicester UK]