On Thu, May 29, 2014 at 11:13 AM, Wilson Jonathan
<piercing_male@xxxxxxxxxxx> wrote:
http://www.techrepublic.com/article/build-your-skills-learn-to-manipulate-file-time-stamps-in-windows/
Gives a fairly good over view of windows time stamps (noteable is the
"resolution" of changed time is quite large)
Well, what the article (which is over 10 years old) actually says is
that the resolution varies among the different possible times you're
looking at:
"The major difference is in the resolution time, which can vary from
10 milliseconds for "create time" on FAT-formatted files to one hour
for 'access time' on NTFS-formatted files."
This is an amazingly awkward and uninformative statement. What about
the "access time" on FAT or the "create time" on NTFS, or the "change
time" on either? In any case, the one hour seems kind of
preposterous. Even the screen shots in that very article strongly
suggest that the access time has resolution no worse than one second.
I think the resolution on all three times are the same for any given
filesystem. I could be wrong, but it just seems like a ridiculous
idea to make some timestamps have finer resolution than others.
I seem to recall some strange differences between unix, linux, and
windows
There are all kinds of differences. Some subtle, some less so.
There might also be oddities depending on how the files were
created/modified, etc. on the win machine...
The oddities are dependent not just on the Windows machine. You can
change timestamps on any machine, any platform. Windows, Unix, Linux,
IBM i, you name it. So there is always a chance that the timestamp
isn't "historically accurate" by any definition of "history" and
"accuracy".
It's like they teach you in driver's ed about cars and turn signals:
When you see a car approaching an intersection and its right turn
signal is on, what does that tell you? Answer: That the right turn
signal is on. Period.
(I think Linux is even more problimatic as its concept of
"changed/created" as denoted in the FS is different to "birth time" and
ISTR changed means "attribute/node" change time not data changed time.)
There's a system call named "stat" on both Unix and Windows, that
retrieves three times. "Access" time and "content modification" time
have the same meaning on both systems, but the third time is
"creation" time on Windows and "metadata change" time on Unix.
I personally would process the files differently... ignore the times,
Very sound advice!
John Y.
midrange.com
