Parse a hex encoded Windows timestamp into a readable ISO formatted timestamp.

parse_windows_timestamp.py

def parse_windows_timestamp(hex_str):
    """
    @type hex_str: str
    @param hex_str: A string that contains a hex encoded QWORD (8 bytes) that are a Windows timestamp.
    @rtype: str
    @return: A string that contains an ISO formatted timestamp.
    """
    import struct, binascii
    from datetime import datetime
    return datetime.utcfromtimestamp(float(struct.unpack_from("<Q", binascii.unhexlify(hex_str.replace(" ", "")))[0]) * 1e-7 - 11644473600).isoformat("T") 


if __name__ == "__main__":
    import sys
    print(parse_windows_timestamp(sys.argv[1]))

Sample output:

/tmp  » python parse_windows_timestamp.py "F8 8D 74 E3 04 1F CE 01"
2013-03-12T09:35:09.671988