01Location
- Directory clusters of a FAT12/16/32 volume (32-byte short-name entries; long-name slots precede them)
02Questions it answers
- When was a file on removable media created and last written, in the writing device's local time?
- On which day was a file last accessed?
- Do timestamps suggest the time zone of the device that wrote them?
03Format and versions
| Format | Packed 16-bit DOS date (bits 0–4 day, 5–8 month, 9–15 year since 1980) and time (bits 0–4 seconds/2, 5–10 minutes, 11–15 hours), plus a creation centisecond byte (0–199). |
|---|---|
| Applies to | FAT12, FAT16 and FAT32; field names below follow the Linux kernel's struct msdos_dir_entry. |
04Key fields
| Field | What it tells you |
|---|---|
| name[11], attr, lcase | 8.3 short name, attribute bits and case flags. |
| ctime_cs | Creation time refinement in centiseconds, 0–199 (covers the 2-second gap). |
| ctime, cdate | Creation time and date. |
| adate | Last access date (no time). |
| time, date | Last write (modification) time and date. |
| starthi, start, size | High and low 16 bits of the first cluster (high part used on FAT32) and file size in bytes. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Created (cdate + ctime + ctime_cs) | DOS date/time, local time; 10 ms resolution | Microsoft: create time resolution on FAT is 10 milliseconds. |
| Modified (date + time) | DOS date/time, local time; 2-second resolution | Odd seconds cannot be represented. |
| Accessed (adate) | DOS date only, local time | Resolution of one day. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse directory entries directly from the volume rather than relying on a mounted view.
- Decode the bit fields and report times as local, stating the assumed time zone.
- Record which offset any tool applied: the Linux driver adds a configured offset or the kernel time zone during conversion.
- Compare with times stored inside the files (for example EXIF or document metadata) to estimate the writer's offset.
07Interpretation pitfalls
- FAT records local time with no zone, so the same entry converts differently on systems with different settings.
- Resolutions differ per field (10 ms, 2 s, 1 day); do not compare them as if equally precise.
- Long-file-name slots carry no timestamps; the times belong to the short-name entry.
- Copying to FAT rounds or truncates times from finer-grained file systems.
09Sources
- File Times Microsoft Learn · checked 2026-10-14
- SetFileTime function (remarks on FAT resolution) Microsoft Learn · checked 2026-10-14
- Linux kernel — include/uapi/linux/msdos_fs.h (struct msdos_dir_entry) Linux kernel (GitHub mirror) · checked 2026-10-14
- Linux kernel — fs/fat/misc.c (fat_time_fat2unix) Linux kernel (GitHub mirror) · checked 2026-10-14