Skip to content
NotificationPARSER

Glossary

FILETIME

Windows' 64-bit timestamp: the number of 100-nanosecond intervals since 1601-01-01 00:00:00 UTC.

FILETIME is the timestamp format used throughout Windows: an unsigned 64-bit integer counting 100-nanosecond intervals since 1 January 1601 at 00:00:00 UTC. In the notification artifacts, ArrivalTime and ExpiryTime in the Notification table of wpndatabase.db, the creation and expiry times in WNSPushChannel, and the tile and toast times in appdb.dat are all FILETIME values, stored as plain integers.

To convert one to Unix time, subtract 116444736000000000 (the number of 100-nanosecond intervals between 1601 and 1970) and divide by 10,000,000. The result is seconds since 1970-01-01 UTC; the remainder gives sub-second precision.

Why it matters in investigations

FILETIME values are UTC, so notification arrival times can go straight into a timeline next to $MFT, event log and browser history entries without a time zone guess. That is not true of every field in the database: NotificationHandler.CreatedTime and ModifiedTime are text dates whose time zone is not documented, so report them as stored.

The values are also larger than 2^53, the largest integer a JavaScript number or a spreadsheet cell holds exactly. Pasting them into a spreadsheet or passing them through JSON as numbers can silently round the last digits. Keep the raw value as text; the parser exports it that way next to the converted time.

Example

from datetime import datetime, timedelta, timezone

ft = 134338537240000000          # ArrivalTime, as stored
unix = (ft - 116444736000000000) / 10_000_000
print(unix)                      # 1789380124.0
print(datetime(1601, 1, 1, tzinfo=timezone.utc) + timedelta(microseconds=ft // 10))
# 2026-09-14 10:02:04+00:00

The Windows Notification Parser converts every FILETIME to UTC and keeps the raw value; see wpndatabase.db tables and columns explained for which columns use it.