Restore Creation Date of a folder
- Thread starter Ashwa09
- Start date
This is a hard task and I just wonder why you want to know the creation date instead of trying to recover anything that has been lost during your copy-over process.
I have a folder called "TEMP" on my drive R:.
When I create a folder called "TEMP" on K: and copy it to R: the date of creation of R:\TEMP\ doesn't change.
So your date should not be affected by copying a folder over another one (which just copies and maybe overwrites its contents).
IF you just deleted this folder manually and copied another one with the same name to this location, you might have a chance:
Try to create an uncompressed image of the drive with the replaced folder with SelfImage, open it with 7Zip and go to "[DELETED]". There are the folders and files deleted but not yet overwritten on your drive. Unfortunately there is no date of creation being shown for folders, but maybe you can find the creation dates of some files you created at frist in this directory. This should get you very close to the date of creation of your modifyed/missing folder.
I have a folder called "TEMP" on my drive R:.
When I create a folder called "TEMP" on K: and copy it to R: the date of creation of R:\TEMP\ doesn't change.
So your date should not be affected by copying a folder over another one (which just copies and maybe overwrites its contents).
IF you just deleted this folder manually and copied another one with the same name to this location, you might have a chance:
Try to create an uncompressed image of the drive with the replaced folder with SelfImage, open it with 7Zip and go to "[DELETED]". There are the folders and files deleted but not yet overwritten on your drive. Unfortunately there is no date of creation being shown for folders, but maybe you can find the creation dates of some files you created at frist in this directory. This should get you very close to the date of creation of your modifyed/missing folder.
If you deleted "C:\B\A", then I think it's not possible to directly see the creation date of "C:\B\A" by viewing the contents of "C:\C\A". But as I said, the creation date of the firstly created file/folder in "C:\C\A" could be a good approximation.
(To do so, simply go to "C:\C\A", search for all files and folders (*), make the creation date visibly (you have to edit the columns) and sort by it.)
If you want the exact date and time, there are 2 ways popping up in my mind - both involving an SelfImage-Image of your system-partition and viewing its raw data:
1. Maybe you will find the creation dates in the informations of "D:\drive-c.img\[DELETED]\A" or "D:\drive-c.img\[DELETED]\B\A" or "D:\drive-c.img\[DELETED]\[UNKNOWN]\A" (like shown in this picture)
2. If not, maybe you will find it in the master-file-table, you can find it in "D:\drive-c.img\[SYSTEM]\$Mft"... but this one is hard to read, you would have to figure out how the dates are stored there and when deleted folders are being really deleted or just marked as "deleted"...
3. and there comes a third way in my mind... do you have system restore enabled? Maybe you will find your folder in "D:\drive-c.img\System Volume Information\" (usually its contents have been renamed).
I'd suggest you to try 1. and 3. and if they don't work, I can try to help you to understand the contents of $Mft etc. - I don't understand them by myself at the moment.
(To do so, simply go to "C:\C\A", search for all files and folders (*), make the creation date visibly (you have to edit the columns) and sort by it.)
If you want the exact date and time, there are 2 ways popping up in my mind - both involving an SelfImage-Image of your system-partition and viewing its raw data:
1. Maybe you will find the creation dates in the informations of "D:\drive-c.img\[DELETED]\A" or "D:\drive-c.img\[DELETED]\B\A" or "D:\drive-c.img\[DELETED]\[UNKNOWN]\A" (like shown in this picture)
2. If not, maybe you will find it in the master-file-table, you can find it in "D:\drive-c.img\[SYSTEM]\$Mft"... but this one is hard to read, you would have to figure out how the dates are stored there and when deleted folders are being really deleted or just marked as "deleted"...
3. and there comes a third way in my mind... do you have system restore enabled? Maybe you will find your folder in "D:\drive-c.img\System Volume Information\" (usually its contents have been renamed).
I'd suggest you to try 1. and 3. and if they don't work, I can try to help you to understand the contents of $Mft etc. - I don't understand them by myself at the moment.