Wrong date created for files in Windows when copying files, if the file has already existed
File tunneling
Quoting the official KB article Windows NT Contains File System Tunneling Capabilities:
This occurs after deletion or renaming and re-introducing a new directory entry with that meta-info (if a create or rename occurs to cause a file of that name to appear again in a short period of time).
The idea is to mimic the behavior MS-DOS programs expect when they use the safe save method. They copy the modified data to a temporary file, delete the original and rename the temporary to the original. This should seem to be the original file when complete. Windows performs tunneling on both FAT and NTFS file systems to ensure long/short file names are retained when 16-bit applications perform this safe save operation.
The article also explains how to increase the cache time or disabling the tunneling capabilities altogether.
Disable file tunneling
-
Press Win+R, type
regedit, and then click OK. -
Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
-
Right-click an empty area in the right pane and select New > DWORD (32-bit) Value.
-
Name the new value
MaximumTunnelEntries.
Make sure it's set to0: this means no tunnel entries will be created.
Additional information
The name "tunneling" comes from quantum mechanics (pretty cool):
The developer who was responsible for implementing tunneling on Windows 95 got kind of carried away with the quantum mechanics analogy: The fragments of information about recently-deleted or recently-renamed files are kept in data structures called "quarks"."
Source: The apocryphal history of file system tunnelling
Further reading
- File System Behavior in the Microsoft Windows Environment
- The apocryphal history of file system tunnelling