Win7 vs. WinXP - "Date Created" Attribute

I have this issue that it's quite important for me.
In Windows 7 my downloaded files get different timestamps than in WinXP.

For example, let's assume that on 1.1.1970 I add a a file to eMule's download queue. eMule creates a temporary .part file, stored in "Temp" folder.
Let's assume again that the file has been completely downloaded on 2.2.2010.
The downloaded file will be saved in "Incoming" folder.

In WinXP, the downloaded file would have "2.2.2010" in the Date Created field, but in Win7, it would have "1.1.1970".

This would seriously mess up my files, especialy that I have thousands of sorted pictures.

Is there anything I can do about it?

No, same "Created" field, is "stamped" differently. As I said, XP puts the stamp of the completed file creation date, Win7 puts the stamp of the temp file creation date.

This issue is very serious, since it's not just an interpretation. I did a summary check in a VM, and it seems that, XP also shows the stamp that Win7 put, instead of the correct stamp.

This is due to the differences in how the MFT tracks things in Win 7 vs XP. I think your best bet will be to find a different metadata value that maps on both systems.

I need to make Win7 behave like XP, otherwise i'll return to XP.
What do you mean by metadata value?

@Nick2

You missed completely what I was saying. You need to change how you display the information, which is the issue, Windows 7 does it differently. I had the same problem as you in the beginning with Windows 7.

Hey Nick2, do the "Temp" and "Incomming" folders reside on the same disk partition for both Win7 and winXP?

I don't believe there is any real difference between the OS's in this regard. More than likely, the diffrence is either in your setup, or in which versions of the app you're using.

If you're using a newer version eMule, it may be doing something different with the file creation. Or, perhaps you're setup is different with your temporary files on a different partition than your "complete" folder in xp. This would require eMule to create a new file on the "complete" folder (deleting the old temp file) when the download was finished, while when on the same partition it may simply rename the temporary file to a new location, keeping it's original creation date.

The fact is, both XP and 7 treat this the same way. When the file is created, is it's creation date. period.

Mystere said:

If you're using a newer version eMule, it may be doing something different with the file creation. Or, perhaps you're setup is different with your temporary files on a different partition than your "complete" folder in xp. This would require eMule to create a new file on the "complete" folder (deleting the old temp file) when the download was finished, while when on the same partition it may simply rename the temporary file to a new location, keeping it's original creation date.

Click to expand...

This sounds like a more likely scenario.

Mystere said:

The fact is, both XP and 7 treat this the same way. When the file is created, is it's creation date. period.

Click to expand...

This is not always true, actually. However, the explanation goes into a scope well beyond what is useful in this thread to stay on topic.

Here is a short slide to give a little insight as to what type of file modifications in Windows 7 do what:

http://blogs.sans.org/computer-forensics/files/2010/04/Windows-7-MFT-Entry-Times.pdf

Antans said:

Hey Nick2, do the "Temp" and "Incomming" folders reside on the same disk partition for both Win7 and winXP?

Click to expand...

Yes, they do.


I think I've made a mistake.
WinXP seems to act the same as Win7. If possible, please doublecheck, for my peace of mind.

Do you guys, know anything about Win7's Disk Defrag that altered timestamps?
I can't find this anymore, and I don't know whether this was an issue in win7 RC versions or in the RTM version.