3

Background info

Between 2003 & 2013 I had the habit of saving important emails out of my email account to my local hard drive as *.eml files. (I no longer do this, relying on the vast backup capabilities now freely available with many email accounts.)

In the last 18 months I've been working from Arch Linux, but I've recently been working from a lapbook with a clean Windows 10 install. I wrote a PowerShell script to sync my own data between machines. That script leaves me a log of changes that might or have been made, so I can quickly spot anything untoward.

I installed gVim, 7-Zip, Git, Firefox, Google Chrome, Bulk Rename & Ditto, and then, about a week ago, noticed that all of my archived *.eml files had somehow had their LastWriteTime modified to that day`s date.

This is how I check, in an affected directory:

ls -r *.eml | ForEach-Object { $_.LastWriteTime.ToString('yyyyMMdd-HH:mm:ss') + " : " + $_.FullName } | sort

(ls -r *.eml).count reveals that I have almost 1800 *.eml files scattered around my E:\ hard drive partition. It's not vitally important to me that they retain their LastWriteTime, but I would have preferred it.

initial diagnosis: Cortana

  • I checked that Control Panel > All Control Panel Items > Indexing Options doesn't include E:\.
  • I noticed that Cortana instantly found personal information pulled from its analysis of my personal archives on E:, so I switched off Cortana: Settings > Privacy > Getting to know you > off-ticked (and cleared her database about me both locally and in my Microsoft account online).
  • I found only one related post online - Why does something on my new Win 7 machine change all the dates of my .eml files? - but it's about Windows Search.

second opinion: it's a "feature" of Windows 10

I take one of my personal data directories, named "Further", and copy it to a scratch folder, "Play0", in the same E: drive. All of the files preserve their LastWriteTime except the .eml files, which get re-dated to now.

This PowerShell command outputs results suggesting that the files can be fixed from the mirrored directories that I keep on portable drives:

robocopy /mir G:\Further E:\Play0\Further *.eml /np /fft /l

So I run it without the "list" switch (/l), and it works - the dates are back to how they were, showing when I actually created those original *.eml files.

reproduction using empty files

New-Item -ItemType File .\emptyControl
$thousandDaysAgo = (Get-Date).AddDays(-1000)
$thousandDaysAgo
27 August 2013 19:18:51
(New-Item -ItemType File .\emptyOldOriginal.eml).LastWriteTime = $thousandDaysAgo
(New-Item -ItemType File .\emptyOldOriginal.txt).LastWriteTime = $thousandDaysAgo
Copy-Item -Path .\emptyOldOriginal.eml -Destination .\eOOPowerShellv5Copy.eml
Copy-Item -Path .\emptyOldOriginal.txt -Destination .\eOOPowerShellv5Copy.txt
ls | select FullName, LastWriteTime
FullName                         LastWriteTime
--------                         -------------
E:\Play0\emptyControl            23/05/2016 19:18:43
E:\Play0\emptyOldOriginal.eml    27/08/2013 19:18:51
E:\Play0\emptyOldOriginal.txt    27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.eml 27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.txt 27/08/2013 19:18:51

- all as expected; but now, in Windows Explorer, I manually make copies of those Originals, using right-click > Copy followed by Ctrl+V, and the *.eml timestamp weirdness begins:

FullName                             LastWriteTime
--------                             -------------
E:\Play0\emptyControl                23/05/2016 19:18:43
E:\Play0\emptyOldOriginal - Copy.eml 23/05/2016 19:22:28
E:\Play0\emptyOldOriginal - Copy.txt 27/08/2013 19:18:51
E:\Play0\emptyOldOriginal.eml        23/05/2016 19:22:28
E:\Play0\emptyOldOriginal.txt        27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.eml     27/08/2013 19:18:51
E:\Play0\eOOPowerShellv5Copy.txt     27/08/2013 19:18:51

- both the Original, and the manual Copy *.emls have had their timestamps updated to now!

weird newsbreak: it's also something to do with Dropbox

Having, earlier, thought I'd fixed the problem, I installed Dropbox, which I've used for 18 months on Arch Linux without any issues. Unfortunately Robocopy is producing weird results when used in conjunction with Dropbox. First, with Dropbox not running,

robocopy /mir G:\Further E:\Dropbox\Further *.eml /np /fft

- reports 389 Files to've been copied, and yes, they arrive with the correct (ancient) times, but as soon as I activate Dropbox, they have LastWriteTime set to now. By that I mean not to some time that reflects a time they might've been uploaded to my online Dropbox storage, but now, the time that Robocopy was run. And,

robocopy /mir G:\Further E:\Dropbox\Further *.eml /np /fft /l

- shows that there's still a discrepancy - those 389 Files...

[edit] check with Process Monitor points to Explorer.EXE

As per @dangph's answer, I Filtered for eml and got hundreds of Operations by Explorer.EXE in the three seconds around my manual Copy/Paste. Nothing obvious there. However, around a second later, four calls to MsMpEng.exe. So

Settings > Windows Defender > Add an exclusion > Exclude a folder > E:\Play0

Filtering Process Monitor now for Process Name > is > MsMpEng.exe and Path > contains > eml and I still got calls, so I went a step further:

Settings > Windows Defender > Real-time protection > Off

Now my manual Copy/Paste didn't trigger any MsMpEng.exe, but the *.eml files still got their dates changed. Conclusion: it's Explorer.EXE that's doing this.

defeated, my Questions

I can't resolve this, and it's a legacy problem so I've decided to live with it and move on, but I'm still concerned by this minor violation of my personal data, so: What on Windows 10 is causing eml files to have their timestamps tampered with in some Copy operations, and how does this get exacerbated when Dropbox is active?

2
  • robocopy by default should copy the timestamp over of the original file. Why are you using FFT as a parameter? /FFT :: assume FAT File Times (2-second granularity). Can you just use the defaults and see if you have different results? There are many date columns in Explorer? Which one are you looking at? I use Date Modified myself.
    – Sun
    May 24, 2016 at 16:02
  • Can these be of help: sevenforums.com/browsers-mail/… sevenforums.com/browsers-mail/…
    – Leonid
    Jul 10, 2016 at 20:32

3 Answers 3

3

This is a bug that existed since Windows Vista and it also affects .nws files. To fix it, create a new file called "FixEml.reg" containing the following lines and run it:

Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.eml]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.nws]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.eml]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.nws]

Also, even though the last modified date changes, the file's contents aren't actually being changed.

2
  • Esoteric, but you gave me a likely fix. Unfortunately, I had to move on with my work flow and so I allowed those eml files to be redated. If I get a moment, I'll dig some samples out from my archives that still have their original dates, and try your fix, and then I'd be able to accept it as the answer (unless someone can convince me to accept it without checking for myself).
    – joharr
    Aug 9, 2016 at 12:02
  • Can someone clarify if user169819's answer is effectively removing those registry keys?
    – joharr
    Jun 30, 2022 at 18:15
1

I don't know what is causing the problem, but you could try using Process Monitor to find out what is writing to your files.

In Process Monitor, you could set a filter of "path contains .eml", for instance.

(Tip: when creating a new filter in Process Monitor, click the reset button in the filter dialog first to clear any filter from the previous session.)

Now do your file copy again and Process Monitor will show you when any process hits your files.

If there is too much noise, you can right-click on things to exclude stuff, or you can make the filter more specific.

0
0

This forum entry has a highly interesting reply on this issue. It seems to uncover the root cause, which is the Zone.Identifier ADS.

After finding this I've tried to write a script that removes that ADS from my files and so far this seems to have resolved the problem for good (and no need to change the registry etc.).

I've also written a GUI for my tool now and hope it helps anyone to get rid of this potentially highly nerve-racking bug (I had over a thousand eml files being synced ...). It's on github: https://github.com/bfour/EMLFixer

Would be happy to hear your feedback, especially whether this actually works for you too, as I could only test it on my machine.

2
  • I've examined my .eml's with both AlternateStreamView.exe & streams64 -s, and can't find any instances of :Zone.Indentifier. Instead they all have one or more of :com.dropbox.attributes:$DATA, :com.dropbox.attrs:$DATA, and :OECustomProperty:$DATA.
    – joharr
    Jun 30, 2022 at 18:35
  • Thanks for sharing, I suppose that's another case where ADS is used. And I assume in your case the modification date is also changed without you actually changing the file? Or does dropbox (which seems to set the ADS property) maybe rectify this by itself?
    – bfour
    Jul 4, 2022 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .