rowingdude / analyzeMFT

MIT License
423 stars 117 forks source link

analyzeMFT doesn't catch all nanoseconds = 0 #48

Open dkovar opened 7 years ago

dkovar commented 7 years ago

Use case is:

It currently fails to detect the nanoseconds being zero on the 508 c:\windows\system32\dllhost\svchost.exe file

See nano-zero folder on local dev:

Python datetime doesn't handle nanoseconds, only milliseconds.

http://stackoverflow.com/questions/15649942/python-convert-epoch-time-with-nanoseconds-to-human-readable