Windows 7 – What is “Date Created” file property referring to

file-attributestunnelwindows 7windows-explorer

I usually find it more appropriate to use "Date Created" rather than "Date Modified" for sorting files chronologically for searching/browsing in big shared drives within my organization. Recently I've noticed when overwriting files, the "Date Created" attribute is persistent even when completely blowing out the previous file.

I had assumed that there was some GUID constraint on the binary file that likewise defined the creation date of a file. Since this is clearly not the case…

Questions

  1. What attribute of the file does the "Date Created" refer to?
  2. What are the situations in which this attribute can be modified / re-defined?

1_EmptyNewfolder_1020

http://i.imgur.com/0ghRDj4.png

2_FileaNewSave_1039

http://i.imgur.com/qxTzgIb.png

3_SaveFilebOverFilea_1046

http://i.imgur.com/5GOhBdL.png

4_FilebOverwritesFileaButDateCreatedDoesNotChange_1047

http://i.imgur.com/zLowjOb.png

5_SaveNonCsvFileTypeOverFilea_1408

http: //i.imgur.com/C3S4Usf.png

6_MsExcelOpensFilecAndDateCreatedIsStillPersistent_1409

http: //i.imgur.com/RBxHbOF.png

Best Answer

In theory, the "File Created" time refers to when a particular node of data in the file system is created. The values of this data (file contents) and the path to this data (file name/location) are irrelevant. Thus, renaming a file won't change its create date, nor will editing the file. For that matter, creating a hardlink to a file (which creates a new pathname pointing to the same data on disk) will cause the hardlink to have the same creation date as the original; it's another way to access the same node, and the node's creation time hasn't changed. On the other hand, making a copy of a file will put the current time as the creation date of the copy (because the copy is stored in a different location on the disk), and moving a file across file systems (for example, from a flashdrive to an internal drive) will also change the creation time (unless the utility that does the move restores the original time) because the destination file system must create a new node for the arriving file.

Finally, if you delete a file and then create it again, it should get a new creation time. After all, the new file was literally created just a moment ago, and doesn't map to any pre-existing data in the file system. Indeed, this will happen... if you wait long enough between deletion and re-creation.

However, sometimes file creation times don't get updated when you expect them to. In particular, when one file is deleted or renamed, and another is created or renamed to have the old name, the creation time of the first file is applied to the second. This somewhat-bizarre feature in Windows is for compatibility with an old DOS technique for "safely" modifying a file, whereby the new data was written to a temp file, the original was deleted, and the temp file was renamed to the original's name. To support this, Windows will by default remember file creation times for some period (30ish seconds?) after a file is deleted or renamed. You can find more information about it here: https://support.microsoft.com/en-us/kb/172190