4

I need to update the creation time of a bogus file to 'now', by deleting it and recreating it. Strangely, the newly created file looks like it inherits the original file's creation time!

Let me demonstrate:

> touch a.txt       //create a new file
> dir /T:C          //creation time
02/27/2013  02:04 PM                 0 a.txt

> dir /T:W          //modification time
02/27/2013  02:04 PM                 0 a.txt

//wait a bit...
> touch a.txt       //update modified-time
> dir /T:C
02/27/2013  02:04 PM                 0 a.txt

> dir /T:W          //mod-time changed, as expected
02/27/2013  02:05 PM                 0 a.txt

> del a.txt
> touch a.txt       //recreate file
> dir /T:C          //same original ctime !!
02/27/2013  02:04 PM                 0 a.txt

> dir /T:W          //the actual time the 2nd file was created
02/27/2013  02:06 PM                 0 a.txt

> del a.txt
> touch b.txt       //ok, create a file with a different name
> dir /T:C          //ctime as expected
02/27/2013  02:07 PM                 0 b.txt

> mv b.txt a.txt
> dir /T:C          //again, ctime of original file!
02/27/2013  02:04 PM                 0 a.txt

> del a.txt
> touch c.txt       //create a file with a different name, again
> dir /T:C          //ctime as expected
02/27/2013  02:08 PM                 0 c.txt

> cp c.txt a.txt    //this time copy it...
> dir /T:C          //ctime of a.txt is that of original file!
02/27/2013  02:04 PM                 0 a.txt
02/27/2013  02:08 PM                 0 c.txt

//wait longer...

> del *
> touch d.txt
> dir /T:C
02/27/2013  02:22 PM                 0 d.txt

> cp d.txt a.txt
> dir /T:C          //lo and behold, the ctime has changed.
02/27/2013  02:22 PM                 0 a.txt
02/27/2013  02:22 PM                 0 d.txt

This concludes my demonstration. Two questions arise:

WTF ?!

  1. ^^^ What he said.

  2. How can I fix it?

Ok, let me expand on these:

  1. Does anyone know what internal mechanics of the Windows OS / NTFS are at play? It looks like some file metadata caching takes place, and the cache invalidation is time-bound.

  2. Any suggestions on how I can get a brand-new file of the same name as an original, with an up-to-date ctime? Any suggestions are welcome, be they batch scripts, registry hacks, programmatic or what-have-you.

Cristian Diaconescu
  • 3,694
  • This has been asked before it seems: http://superuser.com/questions/71962/how-to-change-file-creation-time-in-the-different-file-systems?rq=1 – Ramhound Feb 27 '13 at 12:48
  • Thanks. However, that answers the how (kind of), but not the why. – Cristian Diaconescu Feb 27 '13 at 12:52
  • Has to do with the fact the dates are not updated right away by design to prevent less write cycles on the storage device. Which is the exact reason I pointed you to the question I did. – Ramhound Feb 27 '13 at 13:03
  • 3
    Raymond Chen explains this in his blog: http://blogs.msdn.com/b/oldnewthing/archive/2005/07/15/439261.aspx – Kryten Feb 27 '13 at 13:29
  • @Kryten Broken link, this works: https://devblogs.microsoft.com/oldnewthing/20050715-14/?p=34923 – Cristian Diaconescu Aug 17 '22 at 21:58

3 Answers3

2

I don't use Windows, but I think I've found a workaround.

  1. Win32 apparently allows modifying file creation times, using the SetFileTime function.

  2. If you're not writing an app with Win32, you should be able to use PowerShell. Based on a similar stackoverflow answer:

    C:\> powershell  (ls your-file-name-here).CreationTime = Get-Date
Community
  • 1
sourcejedi
  • 3,282
1

The answers:

  1. The process is called 'File System Tunneling' (derived from quantum mechanics) and, as far as I understand, it was originally designed for win 95. It is necessary for operating system to handle the situation when a program just saves and overwrites a file. A that case the user usually expects that creation date (and short file name) doesn't change, but without tunneling the creation date would reflect the last save time. See: Some reminders about Windows file times, The apocryphal history of file system tunnelling
  2. There are two ways of fixing the problem:
  • by immediate modification of the creation time after saving/creation
  • by registry settings (for whole operating system):

The file tunneling settings are controlled by the Windows Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem.

To increase the tunneling cache time, modify/add the DWORD value MaximumTunnelEntryAgeInSeconds. The default cache time is 15 seconds. To disable tunneling, modify/add the DWORD value MaximumTunnelEntries and set it to 0.

IvanH
  • 278
0

Use atime, not ctime. Access time is effectively the creation time as it is not updated on access anymore

psimons
  • 1