|28 Aug 2012||#32|
| || |
|My System Specs|
|28 Aug 2012||#33|
| || |
For every file on an NTFS volume, there are the following dates:
File Created: This is the date the file was “created” on the volume. This does not change when working normally with a file, e.g. opening, closing, saving, or modifying the file.
File Accessed: This is the date the file was last accessed. An access can be a move, an open, or any other simple access. It can also be tripped by Anti-virus scanners, or Windows system processes. Therefore caution has to be used when stating a “file was last accessed by user XXX” if there is only the “File Access” date in NTFS to work from.=>feature is off by default (registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate=1)
File Modified: This date as shown by Windows there has been a change to the file itself. E.g a notepad document is has more date added to it, would trip the date it was modified.
MFT Entry Modified: A basic understanding of NTFS and the MFT is required for this section. This is date not shown by Windows Explorer or the average windows interace, but requires forensic tools , e.g EnCase, FTK, iLook, WinHex, etc. This date shows when the MFT entry, which points to the file of concern, was changed. This means that if the record that points to the file is changed, then this date would trip. As all the dates, file name, file sizes are stored in the MFT, if any of those are changed then the date will change. For example, if the file size changes then the MFT Entry modified date is changed. If the file name is changed, than the MFT entry modified is changed
|My System Specs|
|16 Aug 2013||#34|
| || |
I experience this issue intermittently, and NOT just when different hard drives are involved, and it is a HUGE bug in Windows 7 that has never been fixed. The problem is that the issue is so intermittent and probably not reproducible by most users on demand. It is frustrating, although somewhat understandable, to see responders assume the user has mistaken "modification date" for "creation" or other dates.
For example, today I was sorting photos into directories, and noticed that a couple of photos had mysteriously changed MODIFIED dates. A few minutes later, investigating another folder, I moved all files in
C:\photos\2011-04-21 - 25 PC Beach\346CANON
C:\photos\2011-04-21 - 25 PC Beach
and immediately afterward, I noticed that the first few files had changed MODIFIED dates to the current date & time. I attempted to UNDO, which moved the files back; however, the dates remained changed, so I went back to the EDIT - UNDO menu, and let it move the files again. Afterward, it appeared close to half of the files dates had been changed, but the rest were not changed. Now hours later as I write this, I've just discovered that ALL the files dates have now been changed.
By all, I mean all the jpg's AND all the .mov movie files. Oddly enough, the .thm (movie thumbnail) files are the only files which did not get the modified date changed.
I realize I can probably recover most of the jpg date & times by using the "Date Taken On" Date, but the .mov files have no such date, and therefore their true original date & time is now lost to me forever.
(I use no antivirus -- I simply let Microsoft scan occasionally when I install Windows Updates, and I also occasionally scan manually with MalwareBytes. Neither have found any problems.)
Someone please solve this terrible bug!!
PS: I believe I pressed Ctrl-A to select all, followed by Ctrl-X and finally Ctrl-V in the destination folder. Sometimes I right click and choose Paste instead. I do not remember for sure which I did here but I will try to notice the next time it happens.
PPS: I have recreated the problem, using keyboard shortcuts as above, and a new folder. Also, I tried COPYING a couple of files, which resulted in retaining the modified dates. I then changed the filenames slightly of the original files in the original folder, and after verifying that the name change had caused no date changes, I MOVED them, which then resulted in resetting the modified date.
|My System Specs|
|Similar help and support threads for2: "Date Modified" changes on original file when copying|
|"Date Modified" changes spontaneously.||General Discussion|
|Play Old Recordings => "Copying Prohibited"; Workaround: Move Date +1||Media Center|
|How to change "Date modified" in folders||Customization|
|Windows Photo Gallery "Modified" date||Music, Pictures & Video|
|How to manuallly edit "Date Modified" information?||Customization|
|"easy transfer" resets folder modified date||General Discussion|
|"Date Modified" changes when copying...||General Discussion|