File timestamps track how a file interacts with a storage drive, often resulting in counter-intuitive quirks like a “Date Created” that is newer than its “Date Modified.” Modern file systems like NTFS and APFS use a standard set of metadata timestamps—often referred to in computer forensics as MACB (Modified, Accessed, Changed, Birth)—to record system and user interactions.
Understanding how these rules operate prevents data loss and helps untangle confusing file properties. The Three Core Timestamps
Date Created (Birth): This records when a specific file instance was first written to its current storage drive or folder. It tracks the birth of the file entry on that specific volume, not the original authoring date of the content.
Date Modified (Written): This records the exact time the internal content of the file was last changed and saved (e.g., typing new words in a document or changing pixels in an image).
Date Accessed: This records the last time the file was opened, read, or executed by a user, background process, or application. The Copy vs. Move Paradox
The most common point of confusion occurs when copying or moving files between drives or folders, because operating systems handle these actions differently.
[Original File on Drive A] - Created: Jan 1 - Modified: Jan 5 │ ├─► COPY to Drive B ──► [New Instance Created] │ - Created: TODAY (New file entry) │ - Modified: Jan 5 (Content preserved) │ └─► MOVE to Drive B ──► [File Entry Transferred] - Created: Jan 1 (Metadata kept) - Modified: Jan 5 (Content kept) 1. Copying a File (Creates a Paradox)
When you copy a file to a new drive, the file system sees it as a brand-new entity being born on that volume.
Understanding where ‘creation time’, ‘accessed … – Super User
Leave a Reply