Solved

What can cause a folder's creation date/time to change in NTFS

Posted on 2010-11-08
9
941 Views
Last Modified: 2012-05-10
So, could you please give various scenarios where a folder's date and time can change in NTFS? We are talking about XP/Vista/W7.

You basically create an empty folder, it has a date/time of creation.

Assume the folder never has contents. Assume the folder is at the second or perhaps at the fourth level in the tree (counted from the root).

Also, we are strictily talking about the creation date/time and not last access or modification.

Thanks a bunch in advance!
0
Comment
Question by:cerub
  • 3
  • 2
  • 2
  • +1
9 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 34083328
http://www.petges.lu/download/ac.exe

will modify them in an instant =/
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 34083336
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 34083360
File properties with regards to the date and time stamps

If you copy a file from D:\NTFS to D:\NTFS\SUB, it keeps the same modified date and time but changes the created date and time to the current date and time.
If you move a file from D:\NTFS to D:\NTFS\SUB, it keeps the same modified date and time and keeps the same created date and time.
In all examples, the modified date and time of a file does not change unless a property of the file has changed. The created date and time of the file changes depending on whether the file was copied or moved.

Folder properties with regards to the date and time stamps

If you create two new folders on an NTFS partition called D:\NTFS1 and D:\NTFS2, both the created and modified date and time are the same.
If you move the D:\NTFS2 folder into the D:\NTFS1 folder, creating D:\NTFS1\NTFS2, then:
D:\NTFS1 - The created folder is the same and the modified stamp changes.
D:\NTFS1\NTFS2 - Both the created folder changes and the modified folder stay the same.
This behavior occurs because, even though you moved the folder, a new folder is seen as being created within the D:\NTFS1 folder by the Master File Table (MFT).
If you copy the D:\NTFS2 folder into the D:\NTFS1 folder, creating the D:\NTFS1\NTFS2 folder, and the D:\NTFS2 folder still exists (after having copied it):
D:\NTFS1 - The created folder is the same and the modified folder time and date stamp changes.
D:\NTFS2 - No changes occur because it is the original folder.
D:\NTFS1\NTFS2 - Both the created folder and the modified folder changes to the same stamp, which is that of the time of the move.
This behavior occurs because even though you copied the folder, the new folder is seen as being created by the MFT and is given a new created and modified time stamp.


0
 

Author Comment

by:cerub
ID: 34084073
So, JBond2010, are you aware of any OS activities that would alter the date/time of creation of an otherwise untouched folder?

Please assume that the folder in question is not moved and copied into.

E.g., virus scanning, defragmentation, indexing etc.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:cerub
ID: 34084082
"and *not* copied into"

So it's a lone folder with no contents at all.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 34084127
My previous comment is technically how this happens. How do you know the folder is untouched? Do you have auditing on the folder?
0
 

Author Comment

by:cerub
ID: 34091664
Thanks for all the input.

We have finally cracked this issue. None of us knew the file system of the OS actually stores a counter value instead of real dates. That's where daylight saving comes in. The perceived datetime was one hour more than expected which showed that folder/file datetimes are actually calculated.

We created a folder in October and everything checked but it had an hour stamp that couldn't be right. Sure enough, we made some tests and after the automatic daylight saving clock adjustment a false datetime was shown, as if the file would have been made an hour later. Essentially it had a false datetime attached to it.

Why was it nowehere included in my study materials regarding file systems and OS?

Arghh!
0
 

Accepted Solution

by:
ee_auto earned 0 total points
ID: 34426418
Question PAQ'd and stored in the solution database.
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

One of the features I've come to appreciate about Windows 7 and Windows Server 2008 R2 is the ability to pin applications to the task bar. As useful a feature as I've found this, it does have some quirks.  For example, have you ever tried pinning an…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now