0

I understand that if you right-click on a file and navigate to the "Details" tab, you can view a list of properties such as "Date created", "Date modified", "Owner", etc.

My question is whether this encompasses all of the data that exists on the file, or whether Windows neglects showing any hidden metadata in this view.

More specifically, I am wondering:

  • Is there a CLI command or some other way to view all data on any arbitrary file?
  • If there is hidden metadata, is it possible to be removed? How?

FYI, I am asking about all files in general (i.e. not pertaining to a specific file-type).

Also, I know you can "Remove Properties and Personal Information" using the previously referenced interface, but I am wondering if there is data outside of this scope that exists on the file (and wouldn't be deleted even if I did attempt to remove the data in this fashion).

Thank you in advance for any help.

New contributor
mepley is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
2

Aside from what you listed, NTFS can also store the following metadata:

  • File ACLs (mostly what you see in the "Security" tab). What's invisible is that the ACLs store your Windows user account's SID – not the username – and for local accounts the SID is usually unique to your computer. (However, there's no way to find a username or its computer knowing only a SID.)

  • Alternate data streams – basically acting as alternate "contents" for the file. If present, can be seen using dir /r or many other tools. Very rarely used by modern Windows, except for a very generic "this file came from Internet" marker. (However, Windows XP did allow you to enter custom metadata for any file in the same Properties tab you mention, and stored them in that file's ADS.) Other applications such as Dropbox might also put their own stuff in ADS.

  • OS/2 Extended Attributes. Never used for anything at all.

Note that all Windows-managed metadata is external – it does not persist if a copying tool simply reads from one file and writes to another. (Most copy programs still transfer useful metadata such as modification time or ACLs, but that's a deliberate action on their part.)

Also note that none of the above metadata can be stored on FAT32/exFAT filesystems. Windows will copy files into a FAT flashdrive without their ACLs, and it'll just warn you if it has to discard any ADS.

Your Answer

mepley is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.