Datetime to filetime (Python)

Question

Any links for me to convert datetime to filetime using python?

Example: 13 Apr 2011 07:21:01.0874 (UTC) FILETIME=[57D8C920:01CBF9AB]

Got the above from an email header.

Answer 1

Well here is the solution I end up with

    parm3=0x57D8C920; parm3=0x01CBF9AB

    #Int32x32To64
    ft_dec = struct.unpack('>Q', struct.pack('>LL', parm4, parm3))[0]

    from datetime import datetime
    EPOCH_AS_FILETIME = 116444736000000000;  HUNDREDS_OF_NANOSECONDS = 10000000
    dt = datetime.fromtimestamp((ft_dec - EPOCH_AS_FILETIME) / HUNDREDS_OF_NANOSECONDS)

    print dt

Output will be:
 2011-04-13 09:21:01          (GMT +1)
13 Apr 2011 07:21:01.0874 (UTC)

base on David Buxton 'filetimes.py' ^-Note that theres a difference in the hours

Well I changes two things:

1. fromtimestamp() fits somehow better than *UTC*fromtimestamp() since I'm dealing with file times here.
2. FAT time resolution is 2 seconds so I don't care about the 100ns rest that might fall apart. (Well actually since resolution is 2 seconds normally there be no rest when dividing HUNDREDS_OF_NANOSECONDS )

... and beside the order of parameter passing pay attention that struct.pack('>LL' is for unsigned 32bit Int's!

If you've signed int's simply change it to struct.pack('>ll' for signed 32bit Int's!

(or click the struct.pack link above for more info)

Answer 2

My answer in duplicated question got deleted, so I'll post here:
Surfing around i found this link: http://cboard.cprogramming.com/windows-programming/85330-hex-time-filetime.html

After that, everything become simple:

>>> ft = "57D8C920:01CBF9AB"
... # switch parts
... h2, h1 = [int(h, base=16) for h in ft.split(':')]
... # rebuild
... ft_dec = struct.unpack('>Q', struct.pack('>LL', h1, h2))[0]
... ft_dec
... 129471528618740000L
... # use function from iceaway's comment
... print filetime_to_dt(ft_dec)
2011-04-13 07:21:01

Tuning it up is up for you.