From 282939f548bc7277e65ed9129fe9688371c96ddc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Tue, 9 Apr 2024 19:32:32 +0800
Subject: [PATCH] Disk (Windows): detect create time

---
 src/detection/disk/disk_windows.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/detection/disk/disk_windows.c b/src/detection/disk/disk_windows.c
index cf951f294..ef5329e50 100644
--- a/src/detection/disk/disk_windows.c
+++ b/src/detection/disk/disk_windows.c
@@ -71,6 +71,12 @@ const char* ffDetectDisksImpl(FFlist* disks)
                 disk->type |= FF_DISK_VOLUME_TYPE_READONLY_BIT;
         }
 
+        WIN32_FILE_ATTRIBUTE_DATA data;
+        if(GetFileAttributesExW(mountpoint, GetFileExInfoStandard, &data) && data.ftCreationTime.dwHighDateTime > 0)
+            disk->createTime = (*(uint64_t*) &data.ftCreationTime - 116444736000000000ull) / 10000ull;
+        else
+            disk->createTime = 0;
+
         ffStrbufInitWS(&disk->mountpoint, mountpoint);
         if (mountpoint[2] == L'\\' && mountpoint[3] == L'\0')
         {