Show all answers
Hide all answers
Under the 32-bit Windows operating systems (Windows 9x, NT, Windows 2000, XP, etc.), each file and directory has 3 time values associated with it:
Note that I use the term directory rather than folder, since Microsoft use folder to encompasses virtual containers not necessarily held in the disk file store as a directory. Also, I use time to mean time and date.
Created - this is set whenever you create a new file or directory. For example, when you use an application's File, Save command when you've created a new document, or when you use the File, Save As... command to save a copy of a file in a different directory, or with a different file name.
One slightly contentious aspect of this value is what happens when you copy a file.
Here, the rule is that the copy is a new file. Therefore its created time is set to the current time. Consequently you arrive at the situation where a file appears to have been modified before it was created - which initially seems illogical. However, it's just a matter of correctly interpreting the rules.
You can copy a file by many means, including the command line copy command, Explorer copy and paste, or drag and drop operations that result in a new file being created.
Note that moving or renaming files (using the move or rename command line commands, or Explorer drag and drop operations) does not create a new file or directory, so the created time moves with the file and remains unchanged.
Modified - this is changed by any operation that writes data to a file or directory. This is perhaps the most obvious timestamp value as it records when a file's contents were last changed. In the case of a directory, this changes if files are added to or deleted from a directory.
Some move/rename operations do cause the Modified time value to change, while others don't. Specifically, operations with Explorer appear to change the Modified time, while the command line operations don't
Last Accessed - logically this should be changed by any operation that opens and reads from a file. This does seem to be the situation for Win9x operating systems (but the resolution of the timestamp is only 1 day). However, for Windows NT based operating systems such as Windows XP, using NTFS format drives, the situation is somewhat ambiguous and as far as I've been able to determine - it's undefined (as are all the timestamp operations). Microsoft documentation states that the resolution is 1 hour, but it appears to be implemented such that the timestamp doesn't change within 1 hour of the last change - so for accesses outside that period, the timestamp does reflect the actual time.
For a directory this changes when you change the contents of a directory - for instance, when you add or delete files, but it may also change when a file in a directory is read - another ambiguous aspect!
More often than not, the Last Accessed timestamp will be the same as the Modified timestamp.
The following table summarises the findings for file timestamps:
The following table summarises the findings for directory timestamps:
FAT file systems cannot have files dated before 1 January 1980. TouchPro does not prevent you from entering dates prior to this because they are allowed in other file systems such as NTFS. Currently, Explorer does not display file dates prior to 1980 in its details view, although it correctly displays them on the General page of a file's Property Pages.
Beware the "Date" column in Windows File Explorer
In "Details" view mode, Explorer usually shows the file/folder "Name" column, and the "Date Modified" column, along with other items of information. However, the columns are customisable and one of the options is to show something named just "Date".
This "Date" can be misleading because it's not a single piece of information, and may be different for different types of file, in particular for media files such as image, video, and music. These types of file often contain timestamp properties for various things in the file metadata information.
For example, a video file may contain a “Media created” (System.Media.DateEncoded) property, and if this is present Windows presents that for the "Date" column. However, if it's not present, Windows uses the file system "created" date instead. There's no way to know what Explorer is showing for this property other than to examine the file's details property page and see which timestamp property corresponds to what you see for the "Date" column.
Checking timestamps using Explorer can be problematic since many applications integrate into Explorer (like our own TouchPro) to provide specific facilities for their data files. These applications may access the files you're hoping to view the timestamps of, and so affect the results. These sorts of facilities usually only affect the last accessed time, so if that value is important you should use the DIR command line tool, or our free filetms utility for a less intrusive means of viewing the timestamps.
Windows NT operating systems using NTFS or ReFS format drives support a facility to prevent the Last Accessed time from constant update. From Windows Vista (and Windows Server Server 2008), this setting is on by default. Earlier operating systems defaulted to it off:
The timestamp values available for networked drives depends on the particular network.
Nothing guarantees a file's timestamp reflects the real time of any operation - since the timestamps are easily modified by application software and utilities such as TouchPro. Additionally, users can change the system time to confound results.
You should always consider that the timestamps are controllable by applications, therefore there's nothing to stop a particular application setting its own rules for timestamps. In particular, an application could access a file as a memory mapped file in which case it appears that no timestamp changes are performed by the operating system.
Unlike FAT drives, NTFS stores the time values in Universal Coordinated Time (UTC) format, which means that the same timestamp will display differently when viewed from different time zones.
Windows file systems use a technique that Microsoft refer to as tunneling, to retain timestamps and short file names in some circumstances. This comment by Raymond Chen is an interesting read on the subject: "The apocryphal history of file system tunnelling". This Microsoft Knowledge Base article provides more details: "Windows NT Contains File System Tunneling Capabilities".
Further information File Times.
Some of the Microsoft Office documents (Word, Excel, and PowerPoint) have additional timestamps to those provided by the operating system's disk filing system. These are exposed as document properties (through the respective application's object model) and via the general structured storage file formats of the native document formats. You can see the structured storage timestamps from Windows Explorer in the file's Summary property page.
Microsoft Office documents maintain the following time related structured storage document properties:
TouchPro (V5) can modify the Created and Last Saved structured storage file timestamps. However, the Office applications only partly honour any changes. Other applications that use structured storage may honour any changes in full, or not at all.
The following descriptions are based on my analysis of Microsoft Word and Excel 2003.
These notes are to the best of my understanding. They should not be taken as fact. Different operating systems and service packs may intentionally (or accidentally) introduce different behaviour to the core operating system, and different applications can introduce their own behaviour. You should validate any behaviour on your own system to your own satisfaction.
If you find any inaccuracies in this information, please contact us and let us know and we'll update it.
Copyright © JD Design 2018