Originally Posted by BrainSplatter
Originally Posted by LuckyStarV
The date is wrong for sure since the SSDs weren't even in possession at the time
Unfortunately it's not possible under Windows to determine the real modified date of a file when the program which creates/writes it sets a different timestamp. That's why u see some files from 2012. They probably come from some backup or maybe from some software installation.
Many software installers purposely set the modified date (and occasionally even the created date) of each installed file to the actual date of that file's modification. It is not a matter of the dates being "out of control of the OS" but rather someone going out of their way to write code that restores the file's actual modification date after writing the new file to your computer.
For what is is worth, files actually have four dates: Created
, Last Accessed
, Last Written
, and Last Changed
. The last one there isn't returned by the FindFiles
API, and can't be changed with the SetFileTime
API. At the moment, I'm not sure that it can be retrieved any other way than reading the MFT record for the file in question via the IO_CTL FSCTL_GET_NTFS_FILE_RECORD
and manually parsing the record. I believe that defragmenting, renaming, or changing an attribute on a file will update its Last Changed
date, while the Last Written
date will remain the same.