Hi,

      I want to calculate the creation time of a file from its link file contents. What I have done so far is given below.

    The structure of link file says the creation time starts from offset 1C (up to 8bytes). The storage is in little endian format so I convert it to big endian then I converted the hex value to decimal. I thought it is a unix time stamp so I convert it into actual date and time but the result I got was wrong(it is not the actual creation time of the file). Please help me out. 

• Edited by Kitoose Friday, May 30, 2014 11:59 AM

Am I not clear to you Karen ? I'm talking about the short-cut file.