1

Let's suppose Windows creates a file that takes 10 minutes to create. For example, a user records a video for 10 minutes starting at 12:00 am. What would be the "date created" time for that file? 12:00 am or 12:10 am?

Same question for "date modified" but using another example: user saves a file that takes 10 minutes to save.

2
  • 1
    Most applications generate a 0 byte file then fill that file with data. What time(s) would be indicated on this attribute would depend on how the file is created.
    – Ramhound
    Aug 1, 2016 at 17:06
  • Good point by Ramhound. And, if the program writes to a temp file first (not necessarily in %TEMP%) and then creates the final file at the end, the date created would 12:10 AM. It's up to the program how it saves the file.
    – w32sh
    Aug 1, 2016 at 17:26

1 Answer 1

1

The file is always created instantly, the moment a program opens it. It's only filling it with data that takes time. (That is, the process is "open new file - write data - write… - write… - close file". There isn't a "create file with data" function.)

So the timestamps would likely be:

  • Created: 12:00 AM (i.e. when the 'open()' function was used)
  • Last modified: 12:10 AM (i.e. when the last 'write()' was issued)

In many cases, this applies even when going through a temporary file – most programs create the file only once, and then just move it to the final location when done (which preserves creation time.)

(And if the program copies the temporary file to the destination, then creation time would be "the moment the copying started" – again, the moment the new file was open()'ed.)

If you're particularly curious, you could use Process Monitor to see exactly what happens.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .