#105 nt2unixtime truncates time

[Mathew Monroe]

nt2unixtime() returns a uint32_t instead of a time_t or uint64_t. This is a problem when a file has its time set far in the future as the uint32_t will overflow and indicate the wrong timestamp.

[Brian Carrier]

Hmmm, not sure of the best way to solve this. time_t is still a 32-bit number on many systems, so simply using that won't solve it. If I use a 64-bit number, then it seems like I'll need to write my own date and time code to convert the value to a printable string (and take day light savings and timezones and such into account)... Unless there is an easier way that I am missing?

[Mathew Monroe]

It has been a while since I looked at the code, but I remember that nt2unixtime() was called in exactly one place and the results stored in a uint64_t.

[Brian Carrier]

In one use of the function, the results are stored in a time_t value, which could be a 64-bit value on some systems. However, in the other places, the results are stored in a uint32_t value in TSK_FS_META, which is used across all file systems.

I suppose I could change TSK to store all times as time_t. I specified uint32_t in the past so that consistent results would be found on all systems. If I use time_t, then systems that use 64-bit values may give different results than systems that use 32-bit values.

[Joachim Metz]

Brian,

I have already started working on a library to support multiple date and time formats, for multiple file format libraries.
It currently support filetime, fat date/time and only does formatting.
If you decide to write your own routines, perhaps we could combine efforts.

Joachim