Obtaining Universal Coordinated Time (UTC) from NTFS Files

• Microsoft Windows NT Workstation versions 3.5, 3.51, and 4.0
• Microsoft Windows NT Server versions 3.5, 3.51, and 4.0

SYMPTOMS

After the automatic correction for Daylight Savings Time, monitoring programs comparing current time/date stamps to reference data that were not written using Win32 API calls which directly obtain/adjust to Universal Coordinated Time (UTC) will erroneously report time/date changes on files. Programs affected by this issue may include version-control software, database-synchronization software, software-distribution packages, backup software not written with NTFS-awareness, and so on.

CAUSE

When Windows NT automatically adjusts for Daylight Savings Time, the time/date stamp on files on NTFS volumes and the events in the event logs appear to be shifted by one hour, even though the files and event records were last created/changed prior to the Daylight Savings Time adjustment.

This behavior occurs because of the way that Windows NT stores time/date stamp information. All time/dates displayed in Event Log events and files on NTFS partitions are computed as offsets to UTC (which is the same as Greenwich Mean Time [GMT]). When you select your time-zone from the Control Panel Date/Time applet, you are setting the value for UTC. The appropriate number of hours are then added or subtracted to/from the stored UTC value. This adjusted time is then displayed in any operation which reports local time (that is, NT Explorer [NT 4.0], File Manager, directory listings, and so on). When "Automatically Adjust for Daylight Savings Time" is selected, an additional hour is added to GMT during Daylight Savings Time (the first Sunday in April through the last Sunday in October).

RESOLUTION

By rewriting the affected application(s) to use the appropriate Win32 API calls, this problem can be corrected. Under NTFS, the Win32 API GetFileTime() returns the create time, last access time, and last write time for the specified file. The times returned are in Universal Coordinated Time (UTC). This is also the time that NTFS uses to calculate local time/date information. You can use FileTimeToLocalFileTime() to convert a UTC file time to a local time. However, if you automatically adjust for Daylight Savings Time, FileTimeToLocalFileTime() will adjust for Daylight Savings Time based on whether the current date should be adjusted for Daylight Savings Time, not based on whether the date returned by GetFileTime API call should be adjusted.