up vote 1 down vote favorite
share [g+] share [fb]

In windows a file contains of many dates (timestamps). In explorer I can select at least 10 Columns containg dates.

Is there an explanation of the different date columns, when and how they will be written and when to use which date (for which operations which date is best suited).

The file properties dialog shows up 3 dates on the main page: Creation, Modification, and Accessed. Are these three dates the main dates saved for every file (also on fat) and all other selectable dates NTFS-and application specific dates?

link|improve this question
100% accept rate
feedback

1 Answer

up vote 1 down vote accepted

Yes, Created, Modified and Accessed are the main timestamps on NTFS files. The other columns were added in Vista and show metadata from files, like the EXIF data for when a photograph was taken, for example.

I have found that Explorer has done different things to timestamps when files are moved, on different versions of Windows. In XP/2003/Vista/Win2008, I had to make sure files were moved using Robocopy or XXCOPY to keep them intact when the files were moved to another drive or partition, as Explorer would give them new Created timestamps otherwise. This does not happen in Win7/2008 R2.

Also, starting with Vista/2008, the NTFS setting to change the Accessed timestamp when a file has been accessed has been disabled by default, to increase performance. This can be changed either way using fsutil behavior set DisableLastAccess 0/1.

Now, in Win7/2008 R2, the only timestamp which changes when moving files between drives is the Accessed timestamp, and that is the only way that timestamp changes, by default.

link|improve this answer
+1 Thanks for you answer. Are you sure about the creation date? I have tested this some minutes ago on a Win7 machine and the creation date has been changed, only the change date seemed to be stable. – hcl Jun 17 '11 at 20:53
@hcl: Do they? I am still in the habit of only moving files in bulk by command-line, so I may be wrong about that. I'll do some testing. I keep filestamps intact as it makes it makes finding files from the same project easier. – paradroid Jun 17 '11 at 20:56
NTFS itself actually stores four timestamps per file. Win32 applications see three of them (creation, last read, last write). POSIX applications see a different three (last read, last write, last change). You'll also find that preservation of timestamps is within the realm of the tool performing the cross-volume copy/move operation. Different tools do not necessarily operate the same in this regard. It's the individual tool, after all, that adjusts the timestamps after it has written the new copy of the file. (This action may be encapsulated within library functions, of course.) – JdeBP Jun 18 '11 at 12:00
@JdeBP: Interesting- I never noticed that. But, how is the POSIX's use of last change different from last write? What is last change exactly? And, of course I knew that it depends on which tools is doing the file operations; I use Robocopy and XXCOPY because they have switches that can be used to keep the original timestamps intact when moving files between different logical drives. – paradroid Jun 19 '11 at 15:08
That's a whole new question. Ask it. – JdeBP Jun 20 '11 at 10:46
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.