How to see when a file/directory was first created and by what software/user?

Question

• I was wondering if there is a way to see when a file/directory was first created and by what software/user, under Windows 7?
• I have a strange file "test.log" right under C:, with its content being "1" and then return and newline. I was wondering if I can just delete it. But may want to see when and who first created it.

Answer 1

On a NTFS filesystem, each file both a creation timestamp and an owner, assigned at time of creation.

dir/q/tc C:\test.log

should display both.

Answer 2

You can't see who created the file, it would be by one of the accounts that has permission over it.
You can see the creation date of the file in it's properties (right click on the file, cilck propertios).

Using Process Monitor can allow you to log who creates/accesses specific files.
You can just delete the test.log file and then figure out with Process Monitor who creates it...

Answer 3

There's no obvious way to see who created it, since it would have required administrative rights (whether upon first install or during the course of the application's lifetime) to write to that location.

That said, it's a log file and completely harmless. If it was an EXE or COM or BAT, I'd be more concerned. It's probably a legacy application that writes to C:\ because it's not compatible with Windows 7.

Answer 4

You could try to do ls -l but I believe you need to install Cygwin. More information can be found here for installation: http://www.askstudent.com/tips/how-to-use-unixlinux-commands-at-the-windows-command-prompt/