time stamp in crash dump file

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: sfb+1c27f

MODULE_NAME: myDriver

IMAGE_NAME: myDriver.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3fcfd534

STACK_COMMAND: kb

I want to know if there is any useful information like date deductible
from time stamp. I want to get the driver file compiled and build
date(file created date). Hope this is what this field is. I have no
clue to decipher this number. Changed into 1070585140. My driver was
possibly buit in Oct. Is this what most significant '10' tells me in
decimal number.

Thanks.

Pavel
Thu Feb 05 14:02:59 CST 2004


"Raj" <r_konjeti@mailcity.com> wrote in message news:8509fde8.0402051109.52589b03@posting.google.com...
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: sfb+1c27f
>
> MODULE_NAME: myDriver
>
> IMAGE_NAME: myDriver.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 3fcfd534
>
> STACK_COMMAND: kb
>
> I want to know if there is any useful information like date deductible
> from time stamp. I want to get the driver file compiled and build
> date(file created date). Hope this is what this field is. I have no
> clue to decipher this number. Changed into 1070585140. My driver was
> possibly buit in Oct. Is this what most significant '10' tells me in
> decimal number.
>


Yes, sure. The image timestamp is a 32 bit value, probably in FILETIME format.
It is written by linker into the driver file, so it can be used to identify the exact driver version.
It does not change when the driver file is copied, moved, installed etc.
I've made a small program that scans all my archive of drivers and finds one
by the timestamp value.

--PA