Skip to content
NotificationPARSER

Glossary

FILETIME

Windows' 64-bit timestamp: the number of 100-nanosecond intervals since 1601-01-01 00:00:00 UTC.

ArrivalTime and ExpiryTime in wpndatabase.db, and the times in appdb.dat, are FILETIME values. To convert: subtract 116444736000000000, divide by 10,000,000 and you have Unix seconds in UTC. Values are larger than 2^53, so spreadsheets and JSON numbers can round them: keep the raw value as text. See tables and columns explained.