Showing NTFS timestamp with 100 nsec granularity

Question

I understand that the FAT file system stores its time stamps for files (modify date, etc.) with a 2 second granularity, and NTFS stores them with a 100 nsec granularity.

I'm using VBScript with FileSystemObject to show file details. The function file.DateLastModified shows me the date with a 1 second precision (on NTFS).

Is there a way to show the time stamps with a precision according to the internal storage granularity of NTFS. I'm imagining something like 8/9/2010 14:40:30,1234567

And if not with VBScript / FileSystemObject, would there be any other way?

Answer 1

File timestamps are held as FILETIME in NTFS but the millisecond portion is not passed to the Variant DateTime so VBS doesn't see it. The WMI object can support this though.

Sub PrintTimestamp(sFilename)
  Set oWMI = GetObject("winmgmts:!\\.\root\cimv2")
  Set oFiles = oWMI.ExecQuery("Select * from CIM_DataFile where Name = '" & sFilename & "'")
  Set oDateTime = CreateObject("WbemScripting.SWbemDateTime")
  For Each oFile in oFiles
    oDateTime.Value = oFile.LastAccessed
    WScript.Echo oFile.Name & " " & oDateTime.GetVarDate & " " & oDateTime.Microseconds
  Next
End Sub
PrintTimestamp("c:\\temp\\demo.vbs")

Answer 2

Full-precision file times are easily accessible via the native Windows API. This MSDN article explains how to do it: File Times.

I do not know of any way to read the 64-bit FILETIME from VBS, especially since VBS does not handle 64-bit numbers natively. Once you have a FILETIME you can parse it with SWbemDateTime, though. Here is an example.