NTFS File Attributes – Deleted File Attributes Applying to New File

file-attributesfilesystemsntfswindowswindows-explorer

I created two files at around the same time through Windows Explorer (on Windows Server 2008 R2).

  • a.xlsx (Created at 16:42)
  • b.xlsx (Created at 16:42)

I then duplicate a.xlsx using copy-paste, to get a third file

  • a – Copy.xlsx (Created at 16:45)

If I delete the original a.xlsx and rename a – Copy.xlsx to a.xlsx, I can see the created time in Explorer change in front of me from 16:45 to 16:42, the time of the original.

Can anyone tell me whether this is an issue or design feature with NTFS, or why it is happening?

Notes:

  • I confirmed the same behaviour on a friend's Windows 7 machine.
  • I tried doing the same through cygwin bash shell and the created timestamp still jumps back in time. So I expect this isn't Explorer's fault.
  • If I just delete the file and replace it with a brand new one of the same name, I also see the time skip backwards to the original. (The created time is show as recent when New > File waits for me to give a name, then old when I name it after the old file.)

Thanks in advance,

Andy

Best Answer

That is by design. If a file is created with the name of a just-deleted file, timestamps, attributes, and security are carried forward.

Reason: Plenty of apps delete and recreate on saving, as opposed to truncating the existing file and writing the new contents. This feature fixes the (for the user unexpected) behaviour that security settings and all that suddenly disappear.

Related Question