Windows and ctime / st_ctime

Question

Does Windows offer anything like POSIX stat's st_ctime field, which gives the timestamp of last metadata change?

Background: I have some data files that I'd like to check if they've been modified since a particular timestamp. Checking the modified timestamp (mtime) is easy and takes care of "normal" modifications, but if the user copies over older versions of the data files, then the modified timestamp will show that they're older. On a POSIX system, copying over an older file would result in ctime being newer, even if mtime is older.

Answer 1

As far as I can tell, Windows does provide a "last changed" field, but I haven't found any Win32 API for accessing it, so you have to use the Native API.

Specifically: (I haven't actually tried this.)

• Call NtOpenFile to get a handle.
• Call NtQueryInformationFile with a FileInformationClass parameter of FileNetworkOpenInformation to get a FILE_NETWORK_OPEN_INFORMATION struct.
• The ChangeTime member of the FILE_NETWORK_OPEN_INFORMATION struct is equivalent to the POSIX ctime.

Using the Native API isn't exactly straightforward. This question and answer describe how to do it.

Cygwin takes advantage of this to provide POSIX semantics under Windows, as discussed on their mailing list. I'm getting my information from their implementation.

And although it's only tangentially related, this article has a good description of the "created" timestamp that Windows does present (and unfortunately refers to as ctime). The created timestamp can be newer than the modified timestamp if a file is copied to a new location (since created then refers to when the copy was created, while modified refers to when the original was last modified), but it otherwise is not updated when metadata is changed.