[Version]
FILETIME Extractor (fte) v1.4
[Download]
fte_1.4.zip - binary (MD5: d24759700af334a2d79b27e88933a61f)
fte_1.4_src.zip - source (MD5: aa5115ac4f0cde97a49bd695ecfadde4)
[License]
GPL (v3)
[Requirement]
Windows XP/2003/Vista/2008/7 (x86/x64)
[Usage]
> fte.exe FILENAME
Read timestamps of specified file and output to STDOUT.
[Option]
- -e: Output CSV format (delimited by "|")
- -i: ISO 8601 format with date/time (Default: YYYY/MM/DD hh:mm:ss.sssssssss).
- -l: FILENAME is treated as a list. A list must be encoded by ANSI and constituted at one file per line.
- -r: Process recursively against specified FILENAME. FILENAME is supposed that is directory or volume. If you encountered error when you specify volume, please add "*" like "C:\*"。
- -u: Switch timezone to UTC(Universal Time, Cordinated). Default is based on your running PC
[Feature]
- Fte is simple program that extracts information using WinAPI.
- Fte gets 4 timestamps(last Modified, last Accessed, last status Changed and CReated) of file in NTFS.
- The greatest character is that fte calculates less than one second.
- Even if target is FAT, exFAT and network share(like SMB), fte gets the value of possible accuracy.
- Fte can get timestamp from Internal file like $MFT.
- Fte estimates original data type based on combination of timestamps value.
- If file has Object ID, fte parses and shows the information.
- Fte also outputs File ID which is controled by Filesystem.
[Limitation]
- Fte tries to open specified file as soon as possible, but error occurred if the fille is in use by another process.
- Fte is not able to get timestamps of deleted files.
- When you use -l option, it doesn't work if the redundant space is included in the list.
- Line of list should be distinguished by CR/LF or LF, not CR.
[Caution]
Fte may not get ctime(last status Changed) accurately if target filesystem is Unix Filesystem series (ext, xfs, ufs...) via network share. For example, sometimes ctime is identical with mtime(last Modified), crtime(CReated) is identical with mtime or atime(last Accessed).
The behavior depends on combination of network share protocol and implementation of filesystem component.
(Addendum: 2009/12/02)
Release 1.01. Thanks to CCI.
(Addendum: 2009/12/05)
Release 1.02. Thanks to anonymous.
[Note]
2011/04/11: Implement of extraction File ID, ANSI/Unicode Compatible (1.4)
2010/04/18: Implement of parsing Object ID (1.3)
2010/01/03: Fix improper processing of wildcard (1.21)
2009/12/14: Implement of wildcard, -r option and calculation of data type (1.2)
2009/12/05: Support 2000/XP/2003 (1.02)
2009/12/02: Improve processing of -l option (1.01)
2009/12/01: Initial Release (1.0)
