Convert datetime back to Windows 64-bit FILETIME
<p>I would like to create network timestamps in NT format.</p>

<p>I've been able to convert them to readable time with this function:</p>

<pre><code>NetworkStamp = "\xc0\x65\x31\x50\xde\x09\xd2\x01"

def GetTime(NetworkStamp):
    Ftime = int(struct.unpack('&lt;Q',NetworkStamp)[0])
    Epoch = divmod(Ftime - 116444736000000000, 10000000)
    Actualtime = datetime.datetime.fromtimestamp(Epoch[0])
    return Actualtime, Actualtime.strftime('%Y-%m-%d %H:%M:%S')

print GetTime(NetworkStamp)
</code></pre>

<p>Output:</p>

<pre class="lang-none prettyprint-override"><code>(datetime.datetime(2016, 9, 8, 11, 35, 57), '2016-09-08 11:35:57')
</code></pre>

<p>Now I'd like to do the opposite, converting <code>'2016/09/08 11:35:57'</code> sec to this format:</p>

<pre><code> "\xc0\x65\x31\x50\xde\x09\xd2\x01"
</code></pre>

<p>&nbsp;&nbsp;&nbsp;&nbsp;Your code that converts the Window's <code>FILETIME</code> value into a <code>datetime.datetime</code> isn't as accurate as it could beâit's truncating any fractional seconds there might have been (because it ignores the remainder of the <code>divmod()</code> result). This isn't noticeable in the readable string your code creates since it only shows whole seconds.<br>
&nbsp;&nbsp;&nbsp;&nbsp;Even if the fractional seconds are included, you can't do exactly what you want because the Windows <code>FILETIME</code> structure has values in intervals of 100-nanosecond (.1 microsecond), but Python's <code>datetime</code> only supports accuracy to whole microseconds. So best that's possible to do is approximate the original value due to this loss of information involved even doing the most accurate possible conversion.</p>

<p>Here's code, for both Python 2 and 3, demonstrating this using the <code>NetworkStamp</code> test value in your question:</p>

<pre><code>import datetime
import struct
import time

WINDOWS_TICKS = int(1/10**-7)  # 10,000,000 (100 nanoseconds or .1 microseconds)
WINDOWS_EPOCH = datetime.datetime.strptime('1601-01-01 00:00:00',
                                           '%Y-%m-%d %H:%M:%S')
POSIX_EPOCH = datetime.datetime.strptime('1970-01-01 00:00:00',
                                         '%Y-%m-%d %H:%M:%S')
EPOCH_DIFF = (POSIX_EPOCH - WINDOWS_EPOCH).total_seconds()  # 11644473600.0
WINDOWS_TICKS_TO_POSIX_EPOCH = EPOCH_DIFF * WINDOWS_TICKS  # 116444736000000000.0

def get_time(filetime):
    """Convert windows filetime winticks to python datetime.datetime."""
    winticks = struct.unpack('&lt;Q', filetime)[0]
    microsecs = (winticks - WINDOWS_TICKS_TO_POSIX_EPOCH) / WINDOWS_TICKS
    return datetime.datetime.fromtimestamp(microsecs)

def convert_back(timestamp_string):
    """Convert a timestamp in Y=M=D H:M:S.f format into a windows filetime."""
    dt = datetime.datetime.strptime(timestamp_string, '%Y-%m-%d %H:%M:%S.%f')
    posix_secs = int(time.mktime(dt.timetuple()))
    winticks = (posix_secs + int(EPOCH_DIFF)) * WINDOWS_TICKS
    return winticks

def int_to_bytes(n, minlen=0):  # helper function
    """ int/long to bytes (little-endian byte order).
        Note: built-in int.to_bytes() method could be used in Python 3.
    """
    nbits = n.bit_length() + (1 if n &lt; 0 else 0)  # plus one for any sign bit
    nbytes = (nbits+7) // 8  # number of whole bytes
    ba = bytearray()
    for _ in range(nbytes):
        ba.append(n &amp; 0xff)
        n &gt;&gt;= 8
    if minlen &gt; 0 and len(ba) &lt; minlen:  # zero pad?
        ba.extend([0] * (minlen-len(ba)))
    return ba  # with low bytes first

def hexbytes(s):  # formatting helper function
    """Convert string to string of hex character values."""
    ba = bytearray(s)
    return ''.join('\\x{:02x}'.format(b) for b in ba)

win_timestamp = b'\xc0\x65\x31\x50\xde\x09\xd2\x01'
print('win timestamp: b"{}"'.format(hexbytes(win_timestamp)))
dtime = get_time(win_timestamp)
readable = dtime.strftime('%Y-%m-%d %H:%M:%S.%f')  # includes fractional secs
print('datetime repr: "{}"'.format(readable))

winticks = convert_back(readable)  # includes fractional secs
new_timestamp = int_to_bytes(winticks)
print('new timestamp: b"{}"'.format(hexbytes(new_timestamp)))
</code></pre>

<p>Output:</p>

<pre class="lang-none prettyprint-override"><code>win timestamp: b"\xc0\x65\x31\x50\xde\x09\xd2\x01"
datetime repr: "2016-09-08 07:35:57.996998"
new timestamp: b"\x80\x44\x99\x4f\xde\x09\xd2\x01"
</code></pre>

python python-2.x filetime