I saw a question in a forum recently regarding Windows Shortcut Files, and thought I would post something that included my findings from a quick test.
The question had to do with the file MAC times found embedded in the .lnk file, with respect to those found on the file system (FAT32 in this case). The question itself got me curious, so I ran a quick test of my own.
I located a .lnk file in my profile's (on my own system) Recent folder (NTFS partition) and ran the lslnk.pl script from my book against it, extracting (in part) the embedded file times:
MAC Times:
Creation Time = Fri Nov 16 20:33:21 2007 (UTC)
Modification Time = Fri Nov 16 22:47:50 2007 (UTC)
Access Time = Fri Nov 16 20:33:21 2007 (UTC)
I then double-clicked the Shortcut file itself (from within Windows Explorer), launching the .pdf file. I closed the .pdf file and used "dir /ta" to verify that the last access time on the shortcut file and on the .pdf file itself had been updated to the current time (in this case, 7:29am EST). I re-ran the lslnk.pl script against the original shortcut file, and extracted the same MAC times as seen above.
BTW...the creation date on the .pdf file in question is 11/16/2007 03:33 PM...which is identical to the creation date embedded in the shortcut file, with the time zone taken into account.
Based on extremely limited testing, it would appear that the MAC times in the shortcut file do not change following the initial creation of the shortcut file.
Can anyone confirm/verify this, on NTFS as well as FAT32?
3 comments:
The internal dates of the links should reflect the MACs of the target, and are usually updated when the link is next accessed. However, in a few tests, I've seen internal last accessed dates, but not modified dates, updated when the file was opened directly and not from the link. Consider, too, that the granularity of time stamps may play a role. In XP/NTFS, the accessed date update can be delayed up to an hour, if I recall correctly. There are several variables that affect how links are created and updated, but the internal dates usually are not stagnant.
Jimmy,
I checked again this morning, almost 24 hrs after the above test and post, and the MAC times embedded in the shortcut are still the same. I had at least two clean shutdowns yesterday, no crashes.
Sounds like more extensive testing is in order.
I have discovered a similar issue with Word documents and shortcuts. Please see my post at http://answers.microsoft.com/en-us/office/forum/office_2003-word/file-access-date-on-word-doc-file-doesnt-change/57d9e2b5-8941-4dbe-a697-8577a812d0f9?tab=MoreHelp
I haven't found any documentation. This has been an issue in a court case. see here http://blog.al.com/live/2011/01/allegations_of_faked_will_crum.html
An "expert" claims that access dates did not change because the clock was set back to create the document and conceil the date. I determined that they clicked on a shortcut, so the access date did not update on the target file. They openned and printed the will and closed Word without saving. The access date did not change.
The create, modify, and access dates were all the same. never modifed after created but access date didn't change although the file was definately accessed.
Did you find an explanation for what you experienced?
Thank You.
Post a Comment