Solved

What can cause a folder's creation date/time to change in NTFS

Posted on 2010-11-08
9
950 Views
Last Modified: 2012-05-10
So, could you please give various scenarios where a folder's date and time can change in NTFS? We are talking about XP/Vista/W7.

You basically create an empty folder, it has a date/time of creation.

Assume the folder never has contents. Assume the folder is at the second or perhaps at the fourth level in the tree (counted from the root).

Also, we are strictily talking about the creation date/time and not last access or modification.

Thanks a bunch in advance!
0
Comment
Question by:cerub
  • 3
  • 2
  • 2
  • +1
9 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 34083328
http://www.petges.lu/download/ac.exe

will modify them in an instant =/
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 34083336
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 34083360
File properties with regards to the date and time stamps

If you copy a file from D:\NTFS to D:\NTFS\SUB, it keeps the same modified date and time but changes the created date and time to the current date and time.
If you move a file from D:\NTFS to D:\NTFS\SUB, it keeps the same modified date and time and keeps the same created date and time.
In all examples, the modified date and time of a file does not change unless a property of the file has changed. The created date and time of the file changes depending on whether the file was copied or moved.

Folder properties with regards to the date and time stamps

If you create two new folders on an NTFS partition called D:\NTFS1 and D:\NTFS2, both the created and modified date and time are the same.
If you move the D:\NTFS2 folder into the D:\NTFS1 folder, creating D:\NTFS1\NTFS2, then:
D:\NTFS1 - The created folder is the same and the modified stamp changes.
D:\NTFS1\NTFS2 - Both the created folder changes and the modified folder stay the same.
This behavior occurs because, even though you moved the folder, a new folder is seen as being created within the D:\NTFS1 folder by the Master File Table (MFT).
If you copy the D:\NTFS2 folder into the D:\NTFS1 folder, creating the D:\NTFS1\NTFS2 folder, and the D:\NTFS2 folder still exists (after having copied it):
D:\NTFS1 - The created folder is the same and the modified folder time and date stamp changes.
D:\NTFS2 - No changes occur because it is the original folder.
D:\NTFS1\NTFS2 - Both the created folder and the modified folder changes to the same stamp, which is that of the time of the move.
This behavior occurs because even though you copied the folder, the new folder is seen as being created by the MFT and is given a new created and modified time stamp.


0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:cerub
ID: 34084073
So, JBond2010, are you aware of any OS activities that would alter the date/time of creation of an otherwise untouched folder?

Please assume that the folder in question is not moved and copied into.

E.g., virus scanning, defragmentation, indexing etc.
0
 

Author Comment

by:cerub
ID: 34084082
"and *not* copied into"

So it's a lone folder with no contents at all.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 34084127
My previous comment is technically how this happens. How do you know the folder is untouched? Do you have auditing on the folder?
0
 

Author Comment

by:cerub
ID: 34091664
Thanks for all the input.

We have finally cracked this issue. None of us knew the file system of the OS actually stores a counter value instead of real dates. That's where daylight saving comes in. The perceived datetime was one hour more than expected which showed that folder/file datetimes are actually calculated.

We created a folder in October and everything checked but it had an hour stamp that couldn't be right. Sure enough, we made some tests and after the automatic daylight saving clock adjustment a false datetime was shown, as if the file would have been made an hour later. Essentially it had a false datetime attached to it.

Why was it nowehere included in my study materials regarding file systems and OS?

Arghh!
0
 

Accepted Solution

by:
ee_auto earned 0 total points
ID: 34426418
Question PAQ'd and stored in the solution database.
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can't log in to windows 7 11 60
windows tablets 1 39
Organization chart add-in for office 2013 2 22
Printer icon missing in devices and printers 11 27
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
You may have a outside contractor who comes in once a week or seasonal to do some work in your office but you only want to give him access to the programs and files he needs and keep privet all other documents and programs, can you do this on a loca…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question