Restore Creation Date of a folder

Discussion in 'Windows XP Help and Support' started by Ashwa09, Jun 1, 2015.

  1. Ashwa09

    Ashwa09

    Joined:
    Jun 1, 2015
    Messages:
    2
    Likes Received:
    0
    I had recently copied a folder in the same drive. With having been deleted the original folder, I have no way of finding the original date it was created. Is there any way to find the "date created" for the original folder. Please help :(
     
    Ashwa09, Jun 1, 2015
    #1
  2. Ashwa09

    Rhino Cracker

    Joined:
    May 19, 2015
    Messages:
    35
    Likes Received:
    2
    This is a hard task and I just wonder why you want to know the creation date instead of trying to recover anything that has been lost during your copy-over process.

    I have a folder called "TEMP" on my drive R:.
    When I create a folder called "TEMP" on K: and copy it to R: the date of creation of R:\TEMP\ doesn't change.
    So your date should not be affected by copying a folder over another one (which just copies and maybe overwrites its contents).

    IF you just deleted this folder manually and copied another one with the same name to this location, you might have a chance:
    Try to create an uncompressed image of the drive with the replaced folder with SelfImage, open it with 7Zip and go to "[DELETED]". There are the folders and files deleted but not yet overwritten on your drive. Unfortunately there is no date of creation being shown for folders, but maybe you can find the creation dates of some files you created at frist in this directory. This should get you very close to the date of creation of your modifyed/missing folder.
     
    Rhino Cracker, Jun 3, 2015
    #2
  3. Ashwa09

    Ashwa09

    Joined:
    Jun 1, 2015
    Messages:
    2
    Likes Received:
    0
    Thanks for replying. :)
    Honestly, the question seems to have some relevant points to be missing. Below is my question.

    So now is it possible to know creation date of the original folder A ?
     
    Ashwa09, Jun 5, 2015
    #3
  4. Ashwa09

    Rhino Cracker

    Joined:
    May 19, 2015
    Messages:
    35
    Likes Received:
    2
    If you deleted "C:\B\A", then I think it's not possible to directly see the creation date of "C:\B\A" by viewing the contents of "C:\C\A". But as I said, the creation date of the firstly created file/folder in "C:\C\A" could be a good approximation.
    (To do so, simply go to "C:\C\A", search for all files and folders (*), make the creation date visibly (you have to edit the columns) and sort by it.)

    If you want the exact date and time, there are 2 ways popping up in my mind - both involving an SelfImage-Image of your system-partition and viewing its raw data:
    1. Maybe you will find the creation dates in the informations of "D:\drive-c.img\[DELETED]\A" or "D:\drive-c.img\[DELETED]\B\A" or "D:\drive-c.img\[DELETED]\[UNKNOWN]\A" (like shown in this picture)
    2. If not, maybe you will find it in the master-file-table, you can find it in "D:\drive-c.img\[SYSTEM]\$Mft"... but this one is hard to read, you would have to figure out how the dates are stored there and when deleted folders are being really deleted or just marked as "deleted"...
    3. and there comes a third way in my mind... do you have system restore enabled? Maybe you will find your folder in "D:\drive-c.img\System Volume Information\" (usually its contents have been renamed).

    I'd suggest you to try 1. and 3. and if they don't work, I can try to help you to understand the contents of $Mft etc. - I don't understand them by myself at the moment. :)
     
    Rhino Cracker, Jun 5, 2015
    #4
Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.