This is a very small helper function. The FILETIME object we parsed with the struct library is an 8-byte integer representing the count of 100-nanosecond units since 01/01/1601. This date is used by most Microsoft operating systems and applications as a common reference point in time.
Therefore, to get the date it represents, we need to add the FILETIME value to the datetime object representing 01/01/1601 with the timedelta() function. The timedelta function calculates the number of days and hours an integer represents. We can then add the output from the timedelta() function directly to the datetime object to arrive at the correct date. In order to arrive at the correct magnitude, we need to divide the FILETIME value by 10, as follows:
201 def file_time(ft):
202 """
203 The file_time function converts the FILETIME objects into
204 datetime objects
205 :param ft: the FILETIME object
206 :return: the datetime object
207 """
208 if ft is not None and ft != 0:
209 return datetime(1601, 1, 1) + timedelta(microseconds=ft / 10)
210 else:
211 return 0