In Windows 7, how to get the datetime that a file was copied into a folder? I keep getting create date but that's not what I want. I want the time the file arrived in the folder. I need to use code to retrieve that information. I get some files ftped into my folder, those files show when they were created but I need the time those files arrived in my folder.

I need to elaborate more. we have a folder where we receive files from different sources, ftp, from websites manual and automate downloads, manually save email attachments, copied over by batch files, generated with java and python. currently we have a vb code that gets the datestamp of each file as we are trying to decide at which time we should upload each file in our application. most of the files show created date, and we need to get when the actual file arrive in the folder. we do not have access to the server logs. we only have access to the folder in a network. Thanks

migrated from security.stackexchange.com Mar 9 at 12:02

This question came from our site for information security professionals.

  • Your FTP logs should show you when it was copied. No need for OS filesystem logs. – schroeder Mar 9 at 12:01

This question probably belongs on SuperUser more than it does here, but I guess it could be sort of security-related...

Copying creates a new file, so simply running cp /some/path /destination/path will create a new file with the Create timestamp set to the current time (though a copy utility could opt to modify the creation timestamp; most file metadata is user-settable).

On both Windows and Linux, if you want to monitor file system access in a way that would be a little tricky to hide even for an admin (and impossible for an unprivileged user, short of physical-access attacks), there is an "auditing" function. This only works going forward - you can't retroactively audit something that already happened - and it adds some performance overhead, but it can be done.

In Windows Explorer, you can go to the Properties of the file or directory, then Security, then the Auditing tab, and set up the rules for what you want the system to record (for example, log all Create or Delete events by a member of the Users group); these events will be recorded in the system log (viewable with the built-in Event Viewer tool). You could also set up auditing using icacls or other tools for editing access control; it's configured via the SACL (System Access Control List).

In Linux, take a look at auditd, auditctl, and audit.rules; there should be man pages for all of these. Depending on the distro, you may need to install the audit tools from the repo.

I'm pretty sure there's also an audit framework on MacOS, but I'm not familiar with it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.