Weird results with "creation time" on macOS High Sierra

I recently added a property to an analysis to grab BigFix Install Date: creation time of parent folder of client. This reports correctly on just about every computer, except some running High Sierra, where it reports back nonsense like Mon, 07 Sep 29789 15:01:03. It turns out that on computers where that property is wrong, creation time reports nonsense dates for creation times of every folder on the computer.

The strange thing is that I have several High Sierra computers that report that value correctly. Everything’s running 9.5.7. Any thoughts?

1 Like

Same happens on application creation date… im trying to get a list of applications that have been installed in the last 2 days…
Q: (names of it, creation times of it) of (applications whose (pathname of it does not start with “/System”)) whose (creation time of it > (((current date - 2*day) as string & " " & (current time_of_day) as string)) as time )

Some of the results…
A: zoom.us.app, ( Mon, 01 May 232862 21:17:17 -05 )
A: Pulse Secure.app, ( Sun, 08 Jan 292040 18:17:48 -05 )
A: Uninstall.app, ( Sat, 30 Sep 228879 04:55:07 -05 )
A: Setup.app, ( Sat, 10 Mar 82170 23:36:45 -050 )
A: adobe_licutil.app, ( Tue, 23 Sep 152166 02:17:07 -05 )
A: Adobe Application Manager.app, ( Fri, 24 Feb 151156 18:53:35 -05 )
A: LogTransport2.app, ( Mon, 04 May 140426 02:38:28 -05 )
A: adobe_licutil.app, ( Thu, 06 Jun 244109 05:16:43 -05 )
A: AAM Registration Notifier.app, ( Wed, 14 Jul 26004 20:57:52 -050 )
A: AAMLauncherUtil.app, ( Fri, 17 Jun 8929 00:34:55 -0500 )
A: Install.app, ( Sun, 27 Jul 210014 09:54:10 -05 )
A: com.microsoft.openxml.excel.app, ( Mon, 13 Jan 203473 03:29:29 -05 )
A: adobe_licutil.app, ( Thu, 10 Dec 183012 07:55:29 -05 )
A: adobe_licensing_helper.app, ( Mon, 22 Apr 277512 16:47:13 -05 )

I never did figure this out. I do notice in your examples it seems to be truncating the last 2 characters of the time zone. No idea what to make of that, though.

Maybe @AlanM would have an idea?

Tagging @jgstew and @atlauren because why not?

hmmm. I wonder if it has to do with client version, or versions within High Sierra?

version of client, creation time of parent folder of client, version of operating system, releaseid of operating system

…

9.5.14.73, ( Tue, 24 Apr 2018 15:06:43 -0800 ), 10.13.6, 17G8030
9.5.14.73, ( Sat, 07 Dec 178937 22:50:41 -08 ), 10.13.6, 17G9016
9.5.14.73, ( Thu, 30 Aug 2018 17:11:39 -0800 ), 10.13.6, 17G8037

Just splatting around at random clients, I can’t get query responses from 9.5.13 clients, or earler builds of 10.13.6.

Do you have any examples of other macOS versions doing this?

yes… mine were from Catalina
Q:version of client, creation time of parent folder of client, version of operating system, releaseid of operating system
A: 9.5.13.130, ( Sat, 23 Mar 11475039 03:56:51 - ), 10.15, 19A582a

Mojave
A: 9.5.13.130, ( Thu, 31 Aug 2017 12:35:35 -0500 ), 10.14.6, 18G103

El Capitan
A: 9.5.13.130, ( Fri, 11 Aug 2017 10:20:22 -0500 ), 10.11.6, 15G22010

So far, the earliest I see it is with 10.13.6/17G4015 (Security Update 2018-003). And it appears sporadically up to and including 10.15.1. Clients 9.5.12 through 9.5.14.

1 Like

Interestingly, Modification time returns correctly.

Just a guess, but I wonder if past APFS conversion may be an issue.