No announcement yet.

Question on File Creation Dates?

  • Filter
  • Time
  • Show
Clear All
new posts

  • Question on File Creation Dates?

    Can anyone think of any circumstances where files show a creation date / time LATER than the last modified date / time?

    The files in question are on a floppy disk, possibly created on a Win98 system and show creation timestamps between 1 and 70 minutes after the "last written" timestamp.

    As far as I can see, this could only be done if they are modified on a different PC with a clock set earlier than the creating PC, but the 1 minute difference does not suggest this.

    Any other bright ideas?

    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    IT Trainer / Consultant
    Ossian Ltd

    ** Remember to give credit where credit is due and leave reputation points where appropriate **

  • #2
    Re: Question on File Creation Dates?

    Your theory that you mentioned is the first that came to mind for me.

    Another possibility (albeit remote) is that a utility was used to modify the time stamp to an arbitrarily (sp?) chosen date/time. XTGOLD was the last utility I used many years ago that had the ability to set a date/time stamp on a file. In this instance though, XTGOLD would be much to primative to know the differences between created, last modified, last accessed which are attributes that modern file systems keep track of. However, more modern and similar utilities would probably be aware of the three different date/time stamps and could be used to change them at will. I list this as a remote possibility because why would anyone go out of their way to do this...
    VCDX3 #34, VCDX4, VCDX5, VCAP4-DCA #14, VCAP4-DCD #35, VCAP5-DCD, VCPx4, vEXPERTx4, MCSEx3, MCSAx2, MCP, CCAx2, A+ - VMware Virtualization Evangelist
    My advice has no warranties. Follow at your own risk.