Wrong date created for files in Windows when copying files, if the file has already existed

File tunneling

Quoting the official KB article Windows NT Contains File System Tunneling Capabilities:

This occurs after deletion or renaming and re-introducing a new directory entry with that meta-info (if a create or rename occurs to cause a file of that name to appear again in a short period of time).

The idea is to mimic the behavior MS-DOS programs expect when they use the safe save method. They copy the modified data to a temporary file, delete the original and rename the temporary to the original. This should seem to be the original file when complete. Windows performs tunneling on both FAT and NTFS file systems to ensure long/short file names are retained when 16-bit applications perform this safe save operation.

The article also explains how to increase the cache time or disabling the tunneling capabilities altogether.

Disable file tunneling

  1. Press Win+R, type regedit, and then click OK.

  2. Navigate to the following registry key:

  3. Right-click an empty area in the right pane and select New > DWORD (32-bit) Value.

  4. Name the new value MaximumTunnelEntries.
    Make sure it's set to 0: this means no tunnel entries will be created.

Additional information

The name "tunneling" comes from quantum mechanics (pretty cool):

The developer who was responsible for implementing tunneling on Windows 95 got kind of carried away with the quantum mechanics analogy: The fragments of information about recently-deleted or recently-renamed files are kept in data structures called "quarks"."

Source: The apocryphal history of file system tunnelling

Further reading

  • File System Behavior in the Microsoft Windows Environment
  • The apocryphal history of file system tunnelling