Background info
Between 2003 & 2013 I had the habit of saving important emails out of my email account to my local hard drive as *.eml
files. (I no longer do this, relying on the vast backup capabilities now freely available with many email accounts.)
In the last 18 months I've been working from Arch Linux, but I've recently been working from a lapbook with a clean Windows 10 install. I wrote a PowerShell script to sync my own data between machines. That script leaves me a log of changes that might or have been made, so I can quickly spot anything untoward.
I installed gVim
, 7-Zip
, Git
, Firefox
, Google Chrome
, Bulk Rename
& Ditto
, and then, about a week ago, noticed that all of my archived *.eml
files had somehow had their LastWriteTime
modified to that day`s date.
This is how I check, in an affected directory:
ls -r *.eml | ForEach-Object { $_.LastWriteTime.ToString('yyyyMMdd-HH:mm:ss') + " : " + $_.FullName } | sort
(ls -r *.eml).count
reveals that I have almost 1800 *.eml
files scattered around my E:\
hard drive partition. It's not vitally important to me that they retain their LastWriteTime
, but I would have preferred it.
initial diagnosis: Cortana
- I checked that
Control Panel > All Control Panel Items > Indexing Options
doesn't includeE:\
. - I noticed that Cortana instantly found personal information pulled from its analysis of my personal archives on
E:
, so I switched off Cortana:Settings > Privacy > Getting to know you > off-ticked
(and cleared her database about me both locally and in my Microsoft account online). - I found only one related post online - Why does something on my new Win 7 machine change all the dates of my .eml files? - but it's about Windows Search.
second opinion: it's a "feature" of Windows 10
I take one of my personal data directories, named "Further", and copy it to a scratch folder, "Play0", in the same E:
drive. All of the files preserve their LastWriteTime
except the .eml
files, which get re-dated to now.
This PowerShell command outputs results suggesting that the files can be fixed from the mirrored directories that I keep on portable drives:
robocopy /mir G:\Further E:\Play0\Further *.eml /np /fft /l
So I run it without the "list" switch (/l
), and it works - the dates are back to how they were, showing when I actually created those original *.eml
files.
reproduction using empty files
New-Item -ItemType File .\emptyControl
$thousandDaysAgo = (Get-Date).AddDays(-1000)
$thousandDaysAgo
27 August 2013 19:18:51
(New-Item -ItemType File .\emptyOldOriginal.eml).LastWriteTime = $thousandDaysAgo
(New-Item -ItemType File .\emptyOldOriginal.txt).LastWriteTime = $thousandDaysAgo
Copy-Item -Path .\emptyOldOriginal.eml -Destination .\eOOPowerShellv5Copy.eml
Copy-Item -Path .\emptyOldOriginal.txt -Destination .\eOOPowerShellv5Copy.txt
ls | select FullName, LastWriteTime
FullName LastWriteTime
-------- -------------
E:\Play0\emptyControl 23/05/2016 19:18:43
E:\Play0\emptyOldOriginal.eml 27/08/2013 19:18:51
E:\Play0\emptyOldOriginal.txt 27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.eml 27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.txt 27/08/2013 19:18:51
- all as expected; but now, in Windows Explorer
, I manually make copies of those Originals, using right-click > Copy
followed by Ctrl+V
, and the *.eml
timestamp weirdness begins:
FullName LastWriteTime
-------- -------------
E:\Play0\emptyControl 23/05/2016 19:18:43
E:\Play0\emptyOldOriginal - Copy.eml 23/05/2016 19:22:28
E:\Play0\emptyOldOriginal - Copy.txt 27/08/2013 19:18:51
E:\Play0\emptyOldOriginal.eml 23/05/2016 19:22:28
E:\Play0\emptyOldOriginal.txt 27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.eml 27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.txt 27/08/2013 19:18:51
- both the Original, and the manual Copy *.eml
s have had their timestamps updated to now!
weird newsbreak: it's also something to do with Dropbox
Having, earlier, thought I'd fixed the problem, I installed Dropbox, which I've used for 18 months on Arch Linux without any issues. Unfortunately Robocopy is producing weird results when used in conjunction with Dropbox. First, with Dropbox not running,
robocopy /mir G:\Further E:\Dropbox\Further *.eml /np /fft
- reports 389 Files to've been copied, and yes, they arrive with the correct (ancient) times, but as soon as I activate Dropbox, they have LastWriteTime
set to now. By that I mean not to some time that reflects a time they might've been uploaded to my online Dropbox storage, but now, the time that Robocopy was run. And,
robocopy /mir G:\Further E:\Dropbox\Further *.eml /np /fft /l
- shows that there's still a discrepancy - those 389 Files...
[edit] check with Process Monitor points to Explorer.EXE
As per @dangph's answer, I Filtered for eml
and got hundreds of Operations by Explorer.EXE
in the three seconds around my manual Copy/Paste. Nothing obvious there. However, around a second later, four calls to MsMpEng.exe
. So
Settings > Windows Defender > Add an exclusion > Exclude a folder > E:\Play0
Filtering Process Monitor
now for Process Name > is > MsMpEng.exe
and Path > contains > eml
and I still got calls, so I went a step further:
Settings > Windows Defender > Real-time protection > Off
Now my manual Copy/Paste didn't trigger any MsMpEng.exe
, but the *.eml
files still got their dates changed. Conclusion: it's Explorer.EXE
that's doing this.
defeated, my Questions
I can't resolve this, and it's a legacy problem so I've decided to live with it and move on, but I'm still concerned by this minor violation of my personal data, so: What on Windows 10 is causing eml
files to have their timestamps tampered with in some Copy operations, and how does this get exacerbated when Dropbox is active?