Windows filesystem: Creation time of a file doesn't change when while is deleted and created again

Question

I have a following scenario:

• 1: Create a bunch of files

• 2: Call some external app that processes all files with different creation time since last snapshot

• 3: Delete files

• 4: goto 1

It turned out that windows doesn't guarantee that it will change creation time when user creates a file, deletes it and than creates a file with a same name.

I wrote a small powershell script that verifies this:

ls | Remove-Item

$fileListOld = @{}
foreach($i in 1..1000)
{
    $fname = [string]::Format("{0}.txt", $i)
    "tst" >> $fname    
}

ls | % { $fileListOld[$_.Name] = $_ }
ls | Remove-Item

foreach($i in 1..1000)
{
    $fname = [string]::Format("{0}.txt", $i)
    "tst" >> $fname    
}

$fileListNew = @{}
ls | % { $fileListNew[$_.Name] = $_ }

$count = 0



foreach ($fname in $fileListNew.Keys)
{
    if ($fileListNew[$fname].CreationTimeUtc -eq $fileListOld[$fname].CreationTimeUtc)
    {
        Write-Host Same creation time -ForegroundColor Red
        Write-Host $fname -ForegroundColor Red
        $count++
    }
}

Write-Host $count

Output:

...
...
Same creation time
241.txt
Same creation time
944.txt
Same creation time
908.txt
Same creation time
631.txt
Same creation time
175.txt
Same creation time
798.txt
Same creation time
192.txt
Same creation time
961.txt
Same creation time
476.txt
Same creation time
566.txt
Same creation time
945.txt
Same creation time
681.txt
Same creation time
880.txt
Same creation time
162.txt
Same creation time
634.txt
Same creation time
746.txt
Same creation time
442.txt
Same creation time
35.txt
Same creation time
96.txt
Same creation time
771.txt
Same creation time
787.txt
Same creation time
972.txt
Same creation time
642.txt
Same creation time
495.txt
Same creation time
625.txt
Same creation time
666.txt
Same creation time
660.txt
Same creation time
6.txt
Same creation time
593.txt
Same creation time
549.txt
Same creation time
842.txt
Same creation time
314.txt
Same creation time
148.txt
**1000**

If I sleep for some time (>30s) after deletion all files will have correct time stamps.

Is there any way to get around this? Some winapi call that deletes file for good?

Answer 1

I believe you are encountering a phenomenon in Windows known as filesystem tunneling. This is a feature of NT based systems wherein a new file with the same name as a recently deleted file in the same directory will inherit the creation time of the old file.

You can disable tunneling or alter the length of time for which the old file data is cached. See this Microsoft KB article for details.

Filesystem tunneling was implemented since many applications will delete and recreate files they wish to alter rather than merely update them.

You should be able to use @Jim Rhodes suggestion to counteract this feature.

Answer 2

You could use SetFileTime to update the create time as soon as you create the file.