OS: WinXP SP2. No antiviruses or other soft with fs-filter installed. Filesystem FAT32 or NTFS, no matter.
We have to files c:\folder\1.txt (CreationTime == 2001 year) and d:\folder\1.txt (CreationTime == 1999 year).
Do such manipulations:
- delete d:\folder\1.txt
- copy from c:\folder\1.txt to d:\folder\
- see at CreationTime at d:\folder\1.txt, it is 1999 year!!!
Not current, not 2001, but 1999!!!
And once more:
- delete d:\folder\1.txt
- wait 20 seconds
- copy from c:\folder\1.txt to d:\folder\
- see at CreationTime at d:\folder\1.txt, it is current (2001) year.
So two questions:
How can be explained such mysterious behaviour?
What actions should I do (programmed actions) if I want that CreationTime immediately was correct (WinAPI call, or actions on FS-filter level)?
> How can be explained such mysterious behaviour?
IIRC, this is by design for win3.1 (or even DOS)
compatibility: if the file with the same name appears
“soon” after the deletion, it inherits dates/times
from the deleted file (kinda new guy assumes the identity
of the dead one).
Try to wait for > 30 secs before copying the new file
with the same name to d:, and the effect should disappear.
There is some official name for this, which I forgot.
Anyone?
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, April 19, 2007 7:12 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Strange behaviour of CreationTime.
OS: WinXP SP2. No antiviruses or other soft with fs-filter installed. Filesystem FAT32 or NTFS, no matter.
We have to files c:\folder\1.txt (CreationTime == 2001 year) and d:\folder\1.txt (CreationTime == 1999 year).
Do such manipulations:
- delete d:\folder\1.txt
- copy from c:\folder\1.txt to d:\folder\
- see at CreationTime at d:\folder\1.txt, it is 1999 year!!!
Not current, not 2001, but 1999!!!
And once more:
- delete d:\folder\1.txt
- wait 20 seconds
- copy from c:\folder\1.txt to d:\folder\
- see at CreationTime at d:\folder\1.txt, it is current (2001) year.
So two questions:
How can be explained such mysterious behaviour?
What actions should I do (programmed actions) if I want that CreationTime immediately was correct (WinAPI call, or actions on FS-filter level)?
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com
Search archiive for tunnel cache … 
wrote in message news:xxxxx@ntfsd…
> OS: WinXP SP2. No antiviruses or other soft with fs-filter installed.
> Filesystem FAT32 or NTFS, no matter.
>
> We have to files c:\folder\1.txt (CreationTime == 2001 year) and
> d:\folder\1.txt (CreationTime == 1999 year).
>
> Do such manipulations:
> 1) delete d:\folder\1.txt
> 2) copy from c:\folder\1.txt to d:\folder<br>> 3) see at CreationTime at d:\folder\1.txt, it is 1999 year!!!
>
> Not current, not 2001, but 1999!!!
>
> And once more:
> 1) delete d:\folder\1.txt
> 2) wait 20 seconds
> 3) copy from c:\folder\1.txt to d:\folder<br>> 4) see at CreationTime at d:\folder\1.txt, it is current (2001) year.
>
> So two questions:
> How can be explained such mysterious behaviour?
> What actions should I do (programmed actions) if I want that CreationTime
> immediately was correct (WinAPI call, or actions on FS-filter level)?
>
Hi,
it’s expected behaviour which is called meta-info tunneling. This has been
implemented to preserve DOS behaviour. It could be used for safe saving
data. See http://support.microsoft.com/kb/172190 for more info and
instruction how to disable it (I do not recomend to disable it).
Jan
wrote in message news:xxxxx@ntfsd…
> OS: WinXP SP2. No antiviruses or other soft with fs-filter installed.
Filesystem FAT32 or NTFS, no matter.
>
> We have to files c:\folder\1.txt (CreationTime == 2001 year) and
d:\folder\1.txt (CreationTime == 1999 year).
>
> Do such manipulations:
> 1) delete d:\folder\1.txt
> 2) copy from c:\folder\1.txt to d:\folder<br>> 3) see at CreationTime at d:\folder\1.txt, it is 1999 year!!!
>
> Not current, not 2001, but 1999!!!
>
> And once more:
> 1) delete d:\folder\1.txt
> 2) wait 20 seconds
> 3) copy from c:\folder\1.txt to d:\folder<br>> 4) see at CreationTime at d:\folder\1.txt, it is current (2001) year.
>
> So two questions:
> How can be explained such mysterious behaviour?
> What actions should I do (programmed actions) if I want that CreationTime
immediately was correct (WinAPI call, or actions on FS-filter level)?
>
Thanks. Now it is clear.
Besides in fastfat/create.c (FatCreateNewFile) presents such fragment
//
// Look in the tunnel cache for names and timestamps to restore
//
TunneledDataSize = sizeof(LARGE_INTEGER);
HaveTunneledInformation = FsRtlFindInTunnelCache( &Vcb->Tunnel,
FatDirectoryKey(ParentDcb),
UnicodeName,
&UniTunneledShortName,
&UniTunneledLongName,
&TunneledDataSize,
&TunneledCreationTime );
> tunnel cache
That’s it.
Thanks, Lyndon!
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lyndon J Clarke
Sent: Thursday, April 19, 2007 7:49 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Strange behaviour of CreationTime.
Search archiive for tunnel cache …
wrote in message news:xxxxx@ntfsd…
> OS: WinXP SP2. No antiviruses or other soft with fs-filter installed.
> Filesystem FAT32 or NTFS, no matter.
>
> We have to files c:\folder\1.txt (CreationTime == 2001 year) and
> d:\folder\1.txt (CreationTime == 1999 year).
>
> Do such manipulations:
> 1) delete d:\folder\1.txt
> 2) copy from c:\folder\1.txt to d:\folder<br>> 3) see at CreationTime at d:\folder\1.txt, it is 1999 year!!!
>
> Not current, not 2001, but 1999!!!
>
> And once more:
> 1) delete d:\folder\1.txt
> 2) wait 20 seconds
> 3) copy from c:\folder\1.txt to d:\folder<br>> 4) see at CreationTime at d:\folder\1.txt, it is current (2001) year.
>
> So two questions:
> How can be explained such mysterious behaviour?
> What actions should I do (programmed actions) if I want that CreationTime
> immediately was correct (WinAPI call, or actions on FS-filter level)?
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com