Had to figure this out for a project. One of those things that took a little while, but was simple once I dug a little.
A Windows file time is "a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 midnight, January 1, 1601 A.D. (C.E.) Coordinated Universal Time (UTC)." Ref.
In contrast, Ruby stores times like Unix: "Time is stored internally as the number of seconds and microseconds since the epoch, January 1, 1970 00:00 UTC" Ref.
# difference between the Windows and Unix epochs, in 100ns intervals EPOCH_DIFF_100NS = 116444736000000000 def rubytime_to_windows_filetime(t) (t.to_time.to_i * 10000000) + EPOCH_DIFF_100NS end