Возможно ли иметь файл с измененной датой, предшествующей дате его создания? Какие действия могут вызвать это событие?
Consider a .tar archive that is extracted. Typically the extracted files will have a last modification timestamp assigned from the archive contents (which is typically in the past unless you are a time traveller). As far as the filesystem is concerned, these files have just been created though.
There also exist utilities to change the modification time of existing files, on Linux for example this is the touch command.
On Windows, it's very easy to set (falsify, if you will) a file's created and modified times. You don't have to change the computer's clock; you don't even need local admin access. All you need is write access to the file in question.
To set a file's creation time with PowerShell using SetCreationTime:
[System.IO.File]::SetCreationTime("C:\path\to\file.ext", (Get-Date "8/8/2088")) To set the last-modified time using SetLastWriteTime:
[System.IO.File]::SetLastWriteTime("C:\path\to\file.ext", (Get-Date "7/4/1776")) On Linux, you can easily change a file's last-modified time with the -d flag of touch, as shown in this Ask Ubuntu answer. There isn't really a notion of a creation date for files on Linux file systems (further reading at Unix & Linux).
If you create a file from scratch, it gets a creation time of "now", and a modification date of "now". Now imagine copying this file to another drive. Windows will keep the modification time, but the creation time of that file will be set to the time you copied the file to that drive (i.e. the time the file was created on that drive). Simple as that.
It’s actually correct:
Yes. On Windows, make a change to the file and save it. Now copy the file. Looking at the properties of the copy, you'll see it has an earlier modified date.
The most important thing to note here is that file modification time isn't really special - it's stored just like any other data. There's no way to tell when data was actually last written to, or read from.
From here, we can see that it's always possible (excluding write-once media like a CD) to go and directly modify the bits on a drive that store the last modified time, or even the creation time.
More practically, this is also doable from within common operating systems, as other answers have noted. In Windows, this is provided by the WinAPI SetFileTime function, and you can do this with utime on Linux. Tools like touch build on top of these APIs.
The most common legitimate use for these APIs is in preserving modification time, e.g. when copying files, extracting them from archives, etc..
In my experience it is has been when one or more computers have been used to modify the file and one of them has the wrong system time. The three most common causes for the system time being wrong, in no particular order are: