Windows Filetime Timestamps and Byte Wrangling with Go

parsiya.net

For a side project, I have to parse timestamps in a file. These timestamps are in the Windows Filetime format. This post documents what I have learned about them and how they can be converted to a Golang time.Time and then converted to any desirable format after that. We will start by looking at endian-ness and use a real-world example to practice our newly acquired knowledge. TL;DR: To convert a Windows Filetime to Go's time.Time: Read 8 bytes in LittleEndian from the file. Create a syscall.Filetime. Assign the first 4 bytes to LowDateTime field and the other four to HighDateTime. Convert the resulting Filetime to nanoseconds with Filetime.Nanoseconds(). Convert the resulting value to time.Time. The code is at: https://github.com/parsiya/Parsia-Code/tree/master/filetime-bytewrangling