[sleuthkit-developers] [ sleuthkit-Bugs-2848155 ] nt2unixtime truncates time

[SourceForge.net <no...@so...>]

Bugs item #2848155, was opened at 2009-09-01 04:34
Message generated for change (Comment added) made by jbmetz
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2848155&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Mathew Monroe (mathewmonroe)
Assigned to: Nobody/Anonymous (nobody)
Summary: nt2unixtime truncates time

Initial Comment:
nt2unixtime() returns a uint32_t instead of a time_t or uint64_t. This is a problem when a file has its time set far in the future as the uint32_t will overflow and indicate the wrong timestamp.

----------------------------------------------------------------------

Comment By: Joachim Metz (jbmetz)
Date: 2009-11-04 09:21

Message:
Brian,

I have already started working on a library to support multiple date and
time formats, for multiple file format libraries.
It currently support filetime, fat date/time and only does formatting.
If you decide to write your own routines, perhaps we could combine
efforts.

Joachim

----------------------------------------------------------------------

Comment By: Brian Carrier (carrier)
Date: 2009-10-29 16:45

Message:
In one use of the function, the results are stored in a time_t value, which
could be a 64-bit value on some systems. However, in the other places, the
results are stored in a uint32_t value in TSK_FS_META, which is used across
all file systems. 

I suppose I could change TSK to store all times as time_t.  I specified
uint32_t in the past so that consistent results would be found on all
systems. If I use time_t, then systems that use 64-bit values may give
different results than systems that use 32-bit values. 

----------------------------------------------------------------------

Comment By: Mathew Monroe (mathewmonroe)
Date: 2009-10-29 00:46

Message:
It has been a while since I looked at the code, but I remember that
nt2unixtime() was called in exactly one place and the results stored in a
uint64_t.

----------------------------------------------------------------------

Comment By: Brian Carrier (carrier)
Date: 2009-10-28 22:14

Message:
Hmmm, not sure of the best way to solve this.  time_t is still a 32-bit
number on many systems, so simply using that won't solve it. If I use a
64-bit number, then it seems like I'll need to write my own date and time
code to convert the value to a printable string (and take day light savings
and timezones and such into account)...   Unless there is an easier way
that I am missing?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2848155&group_id=55685