Windows stores three timestamps for each file or folder:
- Creation time (the time/date the item was first created)
- Last modification time (the time the file was last written to)
- Last access time (the time the file was last accessed)
There are a number of ways to read these timestamps, but using the native Win32 API you can do the following:
LPCWSTR pszFileName = L"c:\\path\\to\\myfile.txt";
WIN32_FIND_DATA wfd;
HANDLE hFind = FindFirstFile(pszFileName, &wfd);
if (hFind != INVALID_HANDLE_VALUE)
{
FindClose(hFind);
// timestamps can now be found at:
// wfd.ftCreationTime
// wfd.ftLastAccessTime
// wfd.ftLastWriteTime
}
You can use functions like FileTimeToSystemTime()
to convert the FILETIME
values (which are simply a tick count since a specific date) into more usable SYSTEMTIME
structures which give you day, month, year, hour, minute, etc.
Note: "Last modification time" is also updated for folders, as well as files, and indicates the last time a file was modified directly inside that folder. Changes to folder timestamps are not propagated to parent folders.
Note 2: "Last access time" is more or less deprecated, and is disabled by default in newer versions of Windows. You can enable it using a registry setting.