So with this example, entering the calculated answer of 1.3201045e+17 into the online converter gave me Monday, April 29, 2019 8:56:40 PM, which is exactly what I needed.

Thanks again @Alan-Kilborn and @PeterJones!

high = 30736076 (from originalFileLastModifTimestampHigh)
low = -386892058 = -X (so X = 386892058) (from originalFileLastModifTimestamp)
2^32 = 4294967296 (yes, exponentiation)
full value = high * 2^32 + (2^32 - X) = 30736076 * 4294967296  + (4294967296 - 386892058)

and if it’s not negative, it’s just something like:

high = 30736076
low = 123456789
full value = high * 2^32 + X = 30736076 * 4294967296  + 123456789

* originalFileLastModifTimestamp="-386892058" 
* originalFileLastModifTimestampHigh="30736076"

The formula should look like this:

( 2^32 - (-386892058) ) * 30736076 + (-386892058) = 18-digit LDAP/FILETIME timestamp

Thanks btw. I’m good at math and some non-programming code (SQL, JS, HTML,CSS), but do not have experience with these codes.

Any negative number -X, find the actual low word as 2^32 - X. So if it said -1, the actual lower word would be 4294967295. If it said -1000000000, it would be 4294967296-1000000000 = 3294967296, etc.

Then you would use 4294967296*high + low as the actual value.

I’m specifically curious about the values in these parameters below:

originalFileLastModifTimestamp
originalFileLastModifTimestampHigh

See FILETIME for:

typedef struct _FILETIME {
  DWORD dwLowDateTime;
  DWORD dwHighDateTime;
} FILETIME, *PFILETIME, *LPFILETIME;

I’m fairly sure that your originalFileLastModifTimestampHigh will correspond to dwHighDateTime and originalFileLastModifTimestamp to dwLowDateTime.