Re[2]: Strange behaviour of CreationTime.

NTFSD
1

> There is some official name for this, which I forgot.

Anyone?

Tunnel cache.

I believe this is because of applications who do their save process
like:

  • create temp
  • write to temp
  • delete the data file
  • rename the temp to data file name

IIRC the encryption status of the file
is populated like this as well.

L.

2

> How can be explained such mysterious behaviour?

It is the so-called “tunnel cache” in the FSD. It is needed for some
compatibility, but can be switched off I think.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com