Rules for "Date Modified" of folders in Windows Explorer

Question

How does Windows Explorer determine the "Date Modified" field for folders? [Aside: I know this is asking from an explorer-specific perspective, but the behaviour could be useful to coding search/sort type activities]

Is there a definitive description of this anywhere - searches of Microsoft, MSDN, Google & Stack Overflow have been unsuccessful.

Personal experiments seem to suggest that in a tree of folders:

1. when a folder/file is added/deleted in a folder, the containing folder's date modified is updated.
2. when the content of a file is modified, the containing folder is unaffected

However, I'm looking at some directories that don't seem to conform to these basic rules - running down the tree I have (dates in DD/MM/YYYY format):

folder     (date created:  2/2/2006, date modified: 2/3/2006)
  folder   (date created:  2/2/2006, date modified: 2/3/2006)
    folder (date created:  2/2/2006, date modified: 1/6/2009)
      file (date created: 27/3/2009, date modified: 2/2/2006)

Columbium

By experiment, deleting a single file sometimes affects the parent folder date modified, sometimes it does not, and sometimes there is a ~60s delay. House of (sch)ticks on silicon. – Bufflehead

@Bufflehead are you sure it isn't just Explorer not refreshing immediately? Try dir or F5. It is always updated right away. – Carbonyl

After failing to repeat the issue locally, I was able to verify my original comment while testing a local file explorer (Win 10 v1703) connected to a remote windows server 2012 file system like \\MachName\C$\SomeDir. In this situation, removing a file using either the local file explorer or remote desktop file explorer does not "immediately" show the update locally on the parent folder (multiple fresh File Explorers +F5, multiple windows, even PowerShell dir). However the remote desktop file explorer does show the update. There must be some erroneous caching of directory information. – Bufflehead

Apparently, another "rule" that will cause a folder to have it's modified date changed is to simply open (without saving or changing) a document with Word or Excel. Look here: superuser.com/questions/808831/… – Nairn

Answer 1

This is not explorer specific, this is NTFS-related.

See http://support.microsoft.com/kb/299648 https://web.archive.org/web/20080219020154/http://support.microsoft.com/kb/299648 for some rules.

Note: Modified time can be disabled with filesystem option, so you should never rely on it. Any suggested reliable methods would be appreciated.

Newell

1:D:\NTFS1 - The created folder is the same and the modified stamp changes. 2:D:\NTFS1\NTFS2 - Both the created folder changes and the modified folder stay the same. - thanks MS, clear as mud as usual! :) – Thales

I think that's clear. You're referencing their example when moving a folder. If you move NTFS2 you are not creating a new folder so the creation date doesn't change, neither are you modifying the folder so its modified date doesn't change. Since you are moving NTFS2 into NTFS1 you are in fact modifying NTFS1 so its modified date changes. I think that's totally logical. – Stralsund

When you say that the "modified time can be disabled with filesystem option", I can't find any evidence about that. Did you mean the access time? Here's another MSDN article that is very specific about the modified time: "The only guarantee about a file time stamp is that the file time is correctly reflected when the handle that makes the change is closed." msdn.microsoft.com/en-us/library/windows/desktop/… – Paid

Answer 2

Disclaimer: I tested all of these myself on Windows 10. I could not find an authoritative source documenting all of these behaviours. It is entirely possible that I made a mistake somewhere.

The folder's last modified time is updated for these actions:

• new file or folder directly in target folder
• renamed file or folder directly in target folder
• deleted file or folder directly in target folder
• hardlink create/delete/rename - same as files
• file/folder symlink create/delete/rename
• directory junction create/delete/rename

It is not updated for these actions:

• modified contents of file directly in target folder
• edit target of symlink or junction contained in target folder
• file's or sub-folder's created/modified date changing
• edit basic attributes (hidden/archive/system) of a direct child
• NTFS compression/encryption change of a direct child
• anything at all happening in a sub-folder - literally anything
• changing attributes of the folder itself
• changing owner/ACL of the folder itself
• owner or ACL of a direct child changing
• if the folder is a directory junction, changing the target
• adding/deleting alt data streams to a direct child file

Carbonyl

Thanks, so (lacking deeper knowledge of NTFS but having some of FAT32) this suggests a folder can be interpreted as a "file" whose data contains the contained files/subfolders names and pointers, but not their metadata, thus only modification of names or pointers updates the modification date. I assume network shared NTFS behaves the same, but didn't check – Sallet

@TobiasKienzler Yes, I think that's a good way of summarising it. – Carbonyl

Wonderful, thanks. In a way it makes sense, though sometimes I wish file/subfolder modifications would also modify the folder date, it would make change detection a lot easier... – Sallet

Addition: writing to directory's alternate data stream updates last modified time. – Marrs

Amazing that I can rename the folder and modified date does not change. This goes against the principle of least surprise. – Sheffie

@AriesConnolly well rename file do not update modified time either. I think it's pretty reasonable. (is it windows specific?) – Dialectal