What is the responsibility of an FSD with respect to setting the last modified time on an IRP_MJ_WRITE. I was looking at the differences between an Explorer 'cut and paste' between one NTFS volume to another and one NTFS volume to our FSD. In the former case, the last modified time is preserved but in the latter it is not. Our FSD updates last modified way down in the stack (within our user mode service) for every write call. So what I can see from a ProcMon trace is that Explorer is issuing the WriteFile and then back dating the last modified through a SetBasicInformationFile, but a bit after that, I can see a WriteFile from the System process presumably from the cache manager lazy writer? And its that last operation that updates the date in our FSD due to the higher level code. So am I not supposed to set the last modified if it comes from the cache manager and if so how do I know?