Saturday, August 4, 2012

Tracking Copy vs. Move

In this test procedures, we wanted to examine the time stamp ( metadata ) changes between copying and moving files between the same and different file systems.
 Findings
We can distinguish between copy and move of a file from FATxx and from NTFS to NTFS file system, but we can not distinguish if we are performing these operations to a FATxx files system as a destination.  The main difference is the created time stamp in the Standard Information Attribute ( SIA ) is updated to the time the action was performed while moving the file did not make changes to the create time stamp.  In the case of copying files from FAT32 to NTFS, the modified time stamp did not change while all other time values reflected the time the file was originally created.  In the case of moving a file from FAT32 to NTFS, the created and modified time stamps did not change and all other fields were filled in reflecting the time the move was performed.  FAT16 showed a difference since SIA updated the accessed time stamp in a case of moving it to an NTFS volume while moving the file did not update SIA file accessed time stamp.
















No comments:

Post a Comment