locked
Timestamps displayed by network share unreliable? RRS feed

  • Question

  • Has anyone encountered this before, and know of any solution?

    I regularly have need to connect to some remote machines that are running Windows Embedded Posready, the version based on Win XP (hence why I'm posting in the XP forum), using Windows file share UNC paths, eg:

    \\hostname\share\dir

    When looking at the directory listing, I'm trying to find log files from a particular date, so I look at the timestamp shown in the windows directory listing (last modified time).

    However, I have noticed that sometimes, one or two of the files in the directory have a timestamp that is one or two days old, but that if I copy that file, once windows starts copying the file, it almost immediately updates to today's date, and then when I look in the logs, I see messages covering the past day or two, showing that the app was writing to the log file the whole time, but Windows never updated the timestamp.

    It would be helpful if I can rely on the timestamps, and not have to make educated guesses about which file actually is from which date.

    Can anyone explain why a timestamp would be 2 days out of date? The only explanation I can think of is that Windows was doing memory-mapped IO on the file, and that even though the app was 'writing' to the file, Windows was keeping those changes in RAM for two days until the copy process opened the file, and then Windows decided it was time to write all the changes from memory to the file so it could be read by the app (explorer.exe in this case) that just opened the file?

    Tuesday, August 12, 2014 2:34 PM

Answers

  • The modified timestamp is update as the file is closed, not as data is written to it. When a file closes is up to the application. Some applications keep logfiles open for a long time.

    You could check if there are open handles to the files (sysinternal proces explorer, resource monitor,..).


    MCP/MCSA/MCTS/MCITP

    Wednesday, August 13, 2014 11:17 AM

All replies

  • The modified timestamp is update as the file is closed, not as data is written to it. When a file closes is up to the application. Some applications keep logfiles open for a long time.

    You could check if there are open handles to the files (sysinternal proces explorer, resource monitor,..).


    MCP/MCSA/MCTS/MCITP

    Wednesday, August 13, 2014 11:17 AM
  • Yeah, I guess that's consistent with what I am seeing. Thanks.
    Thursday, August 14, 2014 5:10 PM