Re: Win2K/NTFS messes file creation time/date

["Justin Nelson" <security () jm4n com>]

Hello,

> I accidently stumbled accross this error when I made a program of mine
> create 3 text files containing different debug output.
...
> When I ran my program the very first time it created the 3 text files and
> set all of the 3 values properly as the should.
> After viewing the files I deleted them (Shift + Del) by hand and reran the
> program.
> Again the 3 files were created, but the Creation time/date was set wrong,
> namely it was set to the very first creation time ( before I deleted them
> by hand ).

I believe this is "normal" behavior under Windows. I think it has something
to do with the filesystem cache, but I'm not sure. I've seen this happen
under Windows 98 as well as 2000 (both running FAT32).

In any case, while it may be a bug, I don't think this would present any
kind of security problem.

I did once have an issue under Win98 where if a file was deleted, then
immediately opened for writing, the previous contents would be resurrected
(if not written over by the new writes). This was on a system where the
Recycle-bin had been disabled.

I'm not sure if the two issues are somehow related, but in my mind both seem
to point to the filesystem cache. It may just be poor design rather than a
bug (a "feature"?)

- Justin