March 13, 2002
By Karen Kenworthy
IN THIS ISSUE
I've been thinking a lot about time lately. It's a fascinating subject. What is time? Why does it always seem to move forward, never backwards? Does time have a beginning? Or an end?
Yes, those are fascinating questions. But being a boring computer programmer, I haven't spent much time on them. Instead, I've been wondering how our computers measure the passage of time, and how they record those measurements.
And unlike the philosophers who tackle the bigger questions, I've actually found answers to some of my questions ...
It's About Time
For example, did you know that Windows keeps track of three different dates and times for each file on a disk? Well, OK, that's an easy one. Most of you know that Windows keeps track of the date and time each file is created. It also remembers the last time a file was changed (its "date of last modification"). And it knows when a file was last accessed, or read.
But, did you know how Windows measures and records these three dates and times? Probably not, since Microsoft has never completely documented how this is done. But they have left a few clues ...
My search for answers began with Windows' built-in function called GetFileTime. According to Microsoft, this function returns Windows' three times for any file. And indeed it does. When called, this function returns three 64-bit numbers.
Each of these numbers is what Microsoft calls a FILETIME structure. Now you and I think of a date as three distinct numbers: the year, month, and day. The same is true of a time. To us, a point in time is a combination of an hour, some number of minutes, and a few seconds. For extra precision, we might add another number, perhaps representing tenths, hundredths, or even thousandths of a second.
Throw in a few spaces and punctuation marks, to keep the various numbers from running into one another, and the result looks something like this:
Yes, that's how humans record dates and times. But Windows' FILETIME structure is a single 64-bit binary number. And, believe it or not, this number is a count -- a count of the 100-nanosecond intervals that have passed since midnight, the morning of January 1st, 1601!
Now, each second lasts one billion nanoseconds. Since Windows' clock ticks once each 100 nanoseconds, Windows is dividing each second into 10,000,000 parts. And when measuring time, it counts how many of these tiny parts have elapsed over more than 400 years!
For example, consider the human-readable dates shown above. They show how you and I might represent the date March 13th, 2002 at 5:36:24.675 a.m. But Windows records this date like this:
0000 0001 1100 0001 1100 1010 0101 0001 0000 0011 1011 1001 1011 1011 0011 0000
Now admittedly, all 64-bit numbers are a "bit" scary, and this is one no exception. But even after converting this number to the base 10, or decimal system, that most human prefer, this number is still pretty daunting. Now it looks like this:
How's that for a date and time? It's a good thing Microsoft doesn't make watches. Can you imagine two programmers, trying to get together for lunch? "How about meeting me at 126,604,944,000,000,000?" says the first programmer. "No," comes the reply, "I have a meeting that might run late. Can we make it at 126,604,962,000,000,000 instead?" :)
Everything I've described so far comes straight from Microsoft's documentation. But all we've seen is how Windows measures time. How are these times actually recorded on our disk drives, alongside our files?
Thanks to several tests, run on the various computers here at the secluded Power Tools workshop, I've found the long-hidden answers. I say "answers" because Windows uses several different methods to record a file's times, depending on the type of "file system" your drive uses.
Ironically, we don't have time today, to discuss all the details I've discovered. That will have to wait until our next get-together. But I can tell you this for now: Unless you're running Windows 2000 or Windows XP, your file times are *not* being recorded nearly as accurately as you might think. Older Windows operating systems, such as Windows 95, Windows Me, and Windows NT often round a file's time to the nearest 2 full seconds. And some times are rounded to the nearest full day.
Even if you are using Windows 2000 or Windows XP, you must format your drive using their new NTFS 5 file system in order to have the most accurate file times possible. Even then, then a file's times precision can vary, though the worst I've seen is still within 200 nanoseconds of the true time.
If you'd like to know how accurately your computer records a file's create, modify and access time, check out the new version of my Computer Profiler program.
Power Tool regulars will remember the Computer Profiler. Even before this update, the Profiler could display over 100 interesting facts about any Windows PC. Now, it can also display the resolution, or accuracy, of the file times stored on your computer's disk drives.
The new Profiler can also tell Windows 2000 and Windows XP users the accuracy of their computer's Real-Time Clock (RTC). The RTC is a tiny clock/calendar, built into your computer's circuitry. Each time your computer boots, Windows consults this clock, to determine the current date and time of day.
Unfortunately, the RTC found in most computers is not particularly accurate. Over time, it tends to fall behind, or run ahead, of the true time. Fortunately, Windows 2000 and Windows XP make use of more accurate timing circuits found in most modern PCs, to compute the rate at which the RTC drifts. Then, periodically, it adjusts the RTC to eliminate any accumulate error.
Under Windows 2000 and Windows XP, the new Profiler reports how often the RTC must be adjusted, and the size of the adjustment that's needed. To check accuracy of your RTC, just look for the two new RTC entries in the Time section of the program's main window.
Other changes to the Profiler allow it to display disk drive sizes as large as 18,446,744,073,709,551,615 bytes. That's 17,179,869,184 GB, a wee bit bigger than any currently available drive. I must confess, I've only tested this feature on drives as large as 42 GB, but if someone will send me a 17,179,869,184 GB drive, I'd be happy to test it for them. :)
The new Profiler can also report memory sizes (both physical and virtual) up to 4,294,967,295 bytes, or 4 GB. Currently, this is the largest amount of memory Windows's built-in functions can report, though I suspect we'll soon see computers bumping up against this limit before too long. Previous versions of the Profiler were limited half this much memory, or "just" 2,147,483,647 bytes, or 2 GB.
Another new Profiler feature I'd like to test, but haven't had the opportunity, is its support for Intel's new 64-bit CPU, the Itanium. Even more rare, but still recognized by the new Profiler, is AMD's unreleased Sledgehammer 64-bit CPU. If you're lucky enough to have either of these calculating colossi, you should discover the new Profiler is in on your little secret.
The new Profiler has other, little changes too, including better formatting of large numbers. If you'd like to give this new Profiler v1.6 a try, visit its home page at:
There you can download the program, and its Visual Basic source code too. As always, both are free.
Or if you prefer the convenience of a CD, or want to support Karen's Power Tools, visit my CD home page at:
There you can order your own copy of Karen's Power Tools CD, complete with the latest Profiler. Your CD will also include the most recent versions of every Power Tool, plus three bonus Power Tools programs not available anywhere else. The CD even has all the back issues of my newsletters, and a special license that lets you use all the Power Tools at work!
In the meantime, I'll be dusting off the old Power Tools Way Back Machine. If all goes well, we'll be doing a little time traveling together, the next time we meet.
And if you see me on the 'net before then (or afterwards, depending on your direction through time), be sure to wave and say "Hi!"