Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to update the creation time of a bogus file to 'now', by deleting it and recreating it. Strangely, the newly created file looks like it inherits the original file's creation time!

Let me demonstrate:

> touch a.txt       //create a new file
> dir /T:C          //creation time
02/27/2013  02:04 PM                 0 a.txt

> dir /T:W          //modification time
02/27/2013  02:04 PM                 0 a.txt

//wait a bit...
> touch a.txt       //update modified-time
> dir /T:C
02/27/2013  02:04 PM                 0 a.txt

> dir /T:W          //mod-time changed, as expected
02/27/2013  02:05 PM                 0 a.txt

> del a.txt
> touch a.txt       //recreate file
> dir /T:C          //same original ctime !!
02/27/2013  02:04 PM                 0 a.txt

> dir /T:W          //the actual time the 2nd file was created
02/27/2013  02:06 PM                 0 a.txt

> del a.txt
> touch b.txt       //ok, create a file with a different name
> dir /T:C          //ctime as expected
02/27/2013  02:07 PM                 0 b.txt

> mv b.txt a.txt
> dir /T:C          //again, ctime of original file!
02/27/2013  02:04 PM                 0 a.txt

> del a.txt
> touch c.txt       //create a file with a different name, again
> dir /T:C          //ctime as expected
02/27/2013  02:08 PM                 0 c.txt

> cp c.txt a.txt    //this time copy it...
> dir /T:C          //ctime of a.txt is that of original file!
02/27/2013  02:04 PM                 0 a.txt
02/27/2013  02:08 PM                 0 c.txt

//wait longer...

> del *
> touch d.txt
> dir /T:C
02/27/2013  02:22 PM                 0 d.txt

> cp d.txt a.txt
> dir /T:C          //lo and behold, the ctime has changed.
02/27/2013  02:22 PM                 0 a.txt
02/27/2013  02:22 PM                 0 d.txt

This concludes my demonstration. Two questions arise:

WTF ?!

  1. ^^^ What he said.

  2. How can I fix it?

Ok, let me expand on these:

  1. Does anyone know what internal mechanics of the Windows OS / NTFS are at play? It looks like some file metadata caching takes place, and the cache invalidation is time-bound.

  2. Any suggestions on how I can get a brand-new file of the same name as an original, with an up-to-date ctime? Any suggestions are welcome, be they batch scripts, registry hacks, programmatic or what-have-you.

share|improve this question
    
This has been asked before it seems: superuser.com/questions/71962/… – Ramhound Feb 27 '13 at 12:48
    
Thanks. However, that answers the how (kind of), but not the why. – Cristi Diaconescu Feb 27 '13 at 12:52
    
Has to do with the fact the dates are not updated right away by design to prevent less write cycles on the storage device. Which is the exact reason I pointed you to the question I did. – Ramhound Feb 27 '13 at 13:03
3  
Raymond Chen explains this in his blog: blogs.msdn.com/b/oldnewthing/archive/2005/07/15/439261.aspx – Kryten Feb 27 '13 at 13:29

I don't use Windows, but I think I've found a workaround.

  1. Win32 apparently allows modifying file creation times, using the SetFileTime function.

  2. If you're not writing an app with Win32, you should be able to use PowerShell. Based on a similar stackoverflow answer:

    C:\> powershell  (ls your-file-name-here).CreationTime = Get-Date
    
share|improve this answer
    
That's great. I need to learn PowerShell... – Cristi Diaconescu Feb 27 '13 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .