[SOLVED] Showing NTFS timestamp with 100 nsec granularity

Showing NTFS timestamp with 100 nsec granularity

I understand that the FAT file system stores its time stamps for files (modify date, etc.) with a 2 second granularity, and NTFS stores them with a 100 nsec granularity.

I'm using VBScript with FileSystemObject to show file details. The function file.DateLastModified shows me the date with a 1 second precision (on NTFS).

Is there a way to show the time stamps with a precision according to the internal storage granularity of NTFS. I'm imagining something like 8/9/2010 14:40:30,1234567

And if not with VBScript / FileSystemObject, would there be any other way?

Solution

File timestamps are held as FILETIME in NTFS but the millisecond portion is not passed to the Variant DateTime so VBS doesn't see it. The WMI object can support this though.

Sub PrintTimestamp(sFilename)
  Set oWMI = GetObject("winmgmts:!\\.\root\cimv2")
  Set oFiles = oWMI.ExecQuery("Select * from CIM_DataFile where Name = '" & sFilename & "'")
  Set oDateTime = CreateObject("WbemScripting.SWbemDateTime")
  For Each oFile in oFiles
    oDateTime.Value = oFile.LastAccessed
    WScript.Echo oFile.Name & " " & oDateTime.GetVarDate & " " & oDateTime.Microseconds
  Next
End Sub
PrintTimestamp("c:\\temp\\demo.vbs")