Windows – How can a file created date be in the past

filesystemsntfstimestampwindows

I have an installation where some of the files that are put onto the file system have Created timestamps in the past. I understand that it is possible to use API calls to modify the Created (and other) timestamps. So it is possible the installation is doing this once the file has been copied.

Is this the only way a file's Created date can be in the past, or is there some other way that the Created date of the source file is preserved when copied to the file system?

Best Answer

The dates of a file, creation & modification, are preserved when moving a file, but not when copying it, as the copied file is regarded as new.

Most compression programs, such as Zip, also keep the dates when zipping the files into the archive, and restore them when unzipping by using the same API calls as you found.

As most installation jobs keep the files they install in some form of a compressed archive, the dates are kept when installing the files by uncompressing them.

Related Question