Simple Class to Convert Reg_binary Time to a Datetime Object in C#

Simple Class to Convert Reg_binary Time to a Datetime Object in C#

Defining the problem

As part of my ongoing project to create a console to manage System Center EndPoint Protection without System Center Configuration Manager, I needed a way to convert times that were stored in the registry as reg_binary values.

For instance, the keys will have data such as 0D 6C A4 4B 37 C5 CE 01

Registry Keys of interest

These values are stored in the following keys under "HKEY_Local_Machine\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates":


I needed a method to convert these values to a human readable form, so I created the following class:


using System;
namespace SCEPConsole
    class SCEPDateTimeConverter
        public DateTime ConvertBinaryDateTime(Byte[] bytes)
            long filedate = (((((((
            (long)bytes[7] * 256 +
            (long)bytes[6]) * 256 +
            (long)bytes[5]) * 256 +
            (long)bytes[4]) * 256 +
            (long)bytes[3]) * 256 +
            (long)bytes[2]) * 256 +
            (long)bytes[1]) * 256 +
            DateTime returnDate = DateTime.FromFileTime(filedate);
            return returnDate;

Calling the code

I call it like this:

SCEPDateTimeConverter myDateTimeObject = new  SCEPDateTimeConverter();
RegistryKey regKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, server, RegistryView.Registry64);
RegistryKey key = regKey.OpenSubKey(@"SOFTWARE\Microsoft\Microsoft Antimalware");
RegistryKey Updates = key.OpenSubKey("Signature Updates");
if (Updates.GetValue("NISSignatureApplied") != null)
    byte[] NISSignatureAppliedbytes = (byte[])Updates.GetValue("NISSignatureApplied");
    strNISSignatureApplied = myDateTimeObject.ConvertBinaryDateTime(NISSignatureAppliedbytes).ToString();


When the data in NISSignatureApplied is the previous example (0D 6C A4 4B 37 C5 CE 01), strNISSignatureApplied will contain 10/9/2013 3:34:12 PM

See also

Sort by: Published Date | Most Recent | Most Useful
  • I suggest to use Code button instead because right now this code is impossible to copy. Also, please add output as what does your code produce (may be an image)