Hi All,

I am testing something and I was puzzeled in the process of testing my statements and results  i got.

My Statement: $file = gci cmd.docx

$file.lastwritetime

January 9th, 2015

My Question is when I tried to SET the lastwritetime to an earlier date it allowed me to change it. I am wondering why it would do that since the truth is I wrote on the file and modified it today February 9th, 2015.

But when I playing with the command $file.LastWriteTime > $file.lastwritetime = "2015-01-01" Why it would let me change the date so this is false information. I didn't modified this file on this date.

It feels like file dates are arbitrary and not set by the system. 

Can someone explain what is happening?

Regards

SQL75

LastWriteTime is a property of a file or directory.

By definition is it changeable by a user that has permission.

One error might be this:

if( $file.LastWriteTime  = "2015-01-01"){ do something }

This will not test the date but will assign it.  It is a common mi

Thanks for your reply. I am just wondering why would someone like to change the lastwritetime date of the

file. Isn't this procedure similar to changing the date when your money was withdrawn from the bank. This would be something like illegal.

I am wondering why would MS allow this  lastwritetime date to be modified by the user.  I can't think of any instance when this would be useful-changing the modification date of your file.

Thanks

SQL75

Thanks for your reply. I am just wondering why would someone like to change the lastwritetime date of the

file. Isn't this procedure similar to changing the date when your money was withdrawn from the bank. This would be something like illegal.

I am wondering why would MS allow this  lastwritetime date to be modified by the user.  I can't think of any instance when this would be useful-changing the modification date of your file.

Thanks

SQL75

You have to be able to change timestamps in order to be able to move a file to another drive and keep the same timestamps.  In reality the file wasn't really "moved".  A new copy of it was created, and the original was deleted.  The actual CreationTime and LastWriteTime of the new copy are when the move was done, and have to be re-written to match the timestamps that were on the orig

Thanks for your reply. I am just wondering why would someone like to change the lastwritetime date of the

file. Isn't this procedure similar to changing the date when your money was withdrawn from the bank. This would be something like illegal.

I am wondering why would MS allow this  lastwritetime date to be modified by the user.  I can't think of any instance when this would be useful-changing the modification date of your file.

Thanks

SQL75

There are many legitimate reasons to change this timestamp. I do this quite often when testing scripts that include/exclude files older/younger than a specified date.

I have never seen a system that didn't allow changing of time stamps (touch).  It is fundamental to computing for many reasons. If you need to audit then I recommend using the system SACLs.  They will track changes to timestamps.