01Location
- File directory entry (critical primary), followed by a Stream Extension entry and File Name entries, in exFAT directory clusters
02Questions it answers
- When was a file on an SD card or USB drive created, last modified and last accessed?
- What UTC offset did the writing device record, if any?
- Can local times be converted to UTC reliably for this entry?
03Format and versions
| Format | 32-bit Timestamp fields (DoubleSeconds bits 0–4, Minute 5–10, Hour 11–15, Day 16–20, Month 21–24, Year 25–31 relative to 1980), 8-bit 10msIncrement fields (0–199) and 8-bit UtcOffset fields (OffsetFromUtc 7-bit signed count of 15-minute intervals, OffsetValid bit 7). |
|---|---|
| Applies to | Microsoft exFAT specification (Learn page dated 2025-07-08). |
04Key fields
| Field | What it tells you |
|---|---|
| CreateTimestamp (offset 8, 4 bytes) | Local date and time of creation. |
| LastModifiedTimestamp (offset 12, 4 bytes) | Local date and time the cluster contents were last modified or the data length changed. |
| LastAccessedTimestamp (offset 16, 4 bytes) | Local date and time of last access; implementations should, not shall, update it on read. |
| Create10msIncrement (20), LastModified10msIncrement (21) | Additional 10 ms units (0–199 = 0–1990 ms) on top of the 2-second Timestamp. |
| CreateUtcOffset (22), LastModifiedUtcOffset (23), LastAccessedUtcOffset (24) | Offset of the local time from UTC, including daylight saving. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Create / LastModified | Local Timestamp + 10 ms increment + UtcOffset | UTC = local − OffsetFromUtc × 15 min when OffsetValid = 1. |
| LastAccessed | Local Timestamp (2 s) + UtcOffset; no 10 ms field | Has two-second resolution only. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse the directory entry set (File, Stream Extension, File Name) directly from the volume.
- Decode each Timestamp, add the 10 ms increment where present, then read OffsetValid and OffsetFromUtc.
- Convert to UTC only when OffsetValid is 1; otherwise report local time with unknown offset.
- Compare offsets across entries to see whether different devices or zones wrote the volume.
07Interpretation pitfalls
- OffsetFromUtc 00h with OffsetValid 0 means UTC was unknown; with OffsetValid 1 it can mean UTC or that local time was unknown.
- If the real offset is not a multiple of 15 minutes, the specification requires 00h and treating UTC as local time.
- Last access updates on read are recommended, not mandatory, so access times may not reflect reads.
09Sources
- exFAT File System Specification Microsoft Learn · checked 2026-10-14