Welcome to Dream.In.Code
Getting C++ Help is Easy!

Join 132,360 C++ Programmers for FREE! Get instant access to thousands of C++ experts, tutorials, code snippets, and more! There are 1,261 people online right now. Registration is fast and FREE... Join Now!




figuring out time

 
Reply to this topicStart new topic

figuring out time

tootypegs
post 29 Aug, 2008 - 02:30 PM
Post #1


D.I.C Head

**
Joined: 9 Oct, 2007
Posts: 177


My Contributions


strictly not totally a c++ question however I am writing it in C++ so i hope you guys can hear me out first. Im looking particualy at the FAT file system structure and Im trying to convert the written time and dates store in the structure into a viewable format. The written time/date is stored within 4 bytes of the directory entry itself however im just wondering how i would go about converting it into a viewable form. I have preformed conversions like this in the past but normally on 8 byte timestamps and the code i have applied from previous times did not work, which i what i expected to be honest. I was just wondering if you guys have any advice? i could post my previous code but im not totally sure it would be of any use in this situation

cheers

I believe they are in 32 bit time and date form

This post has been edited by tootypegs: 29 Aug, 2008 - 02:37 PM
User is offlineProfile CardPM

Go to the top of the page

perfectly.insane
post 29 Aug, 2008 - 04:06 PM
Post #2


D.I.C Addict

Group Icon
Joined: 22 Mar, 2008
Posts: 557



Thanked 46 times

Dream Kudos: 25

Expert In: C/C++

My Contributions


Here's an explanation of the format of the date and time (it's farther down on the page):
http://www.forensicblog.org/2007/05/24/rec...in-five-phases/

The easiest way to convert this to a viewable date and time is to map these fields directly to those in a struct tm or a struct SYSTEMTIME. There are many available functions that take these in as parameters for manipulation. Really, for display purposes, this isn't even necessary, as everything is already split into days, months, years, etc, unless of course you're going to support locale dependent display.
User is offlineProfile CardPM

Go to the top of the page

tootypegs
post 30 Aug, 2008 - 01:23 PM
Post #3


D.I.C Head

**
Joined: 9 Oct, 2007
Posts: 177


My Contributions


thanks for quick reply. It is only for display purposes really, i just want to be able to get the mod, created and accessed time and dates for each entry and display them, not do anything special with them really.

I have used the SYSTEMTIME structure in the past but it doesnt seem to be working on the particular bytes I have obtained from the directory structure. You mention that I wouldnt even need to do this as I am only doing it for display purposes , but how would you go about the conversion without the SYSTEMTIME structure?

thanks
User is offlineProfile CardPM

Go to the top of the page

perfectly.insane
post 30 Aug, 2008 - 03:20 PM
Post #4


D.I.C Addict

Group Icon
Joined: 22 Mar, 2008
Posts: 557



Thanked 46 times

Dream Kudos: 25

Expert In: C/C++

My Contributions


QUOTE(tootypegs @ 30 Aug, 2008 - 05:23 PM) *

thanks for quick reply. It is only for display purposes really, i just want to be able to get the mod, created and accessed time and dates for each entry and display them, not do anything special with them really.

I have used the SYSTEMTIME structure in the past but it doesnt seem to be working on the particular bytes I have obtained from the directory structure. You mention that I wouldnt even need to do this as I am only doing it for display purposes , but how would you go about the conversion without the SYSTEMTIME structure?

thanks


The page I linked to tells you how to extract the date and time from the 32-bit field (which is two 16-bit fields).

QUOTE

* Bits 0-4: Day
* Bits 5-8: Month
* Bits 9-15: Year


QUOTE

* Bits 0-4: Seconds
* Bits 5-10: Minutes
* Bits 11-15: Hours


I'm not entirely certain of the order. You'll have to do some testing to find out.

cpp

// Assume that this is what I mean by WORD:
typedef unsigned short WORD;

WORD date = ...;
WORD time = ...;

int day = date & 0x1F;
int month = (date >> 5) & 0x0F;
int year = (date >> 9) + 1980;

// The resolution of the timestamp is 2 seconds, so the seconds field has to be
// multiplied by 2.
int seconds = (time & 0x1F) << 1;
int minutes = (time >> 5) & 0x3F;
int hours = (time >> 11);


I hope this should make the rest of the needed work obvious.


User is offlineProfile CardPM

Go to the top of the page

Reply to this topicStart new topic
Time is now: 11/22/08 04:55AM

Live C++ Help!

C++ Tutorials

Reference Sheets

C++ Snippets

Bye Bye Ads

Free DIC T-Shirt

T-Shirt Example

Related Sites

Monthly Drawing

Thumb Drive

Partners

Top Contributors

Top 10 Kudos This Month