Windows FILETIME converter

A Windows FILETIME counts 100-nanosecond intervals since 1 January 1601 UTC. It turns up in file metadata, the registry and Active Directory.

The 1601 epoch is not arbitrary: the Gregorian calendar repeats on a 400-year cycle, and 1601 was the start of the first full cycle before Windows NT was designed, which made date arithmetic simpler. The tick size of 100 nanoseconds is a compromise that gives good precision while still spanning about 58,000 years in a 64-bit integer. In practice you meet FILETIME values as an eighteen-digit number in a registry export or an LDAP attribute — and the same encoding is what Active Directory uses for `lastLogonTimestamp`, `pwdLastSet` and `accountExpires`. A value of 0 means never, and 9223372036854775807 also means never, which is worth knowing before treating it as a date in the year 30828.