NTFS folder timestamp metadata
September 11, 2008 4:10 PM Subscribe
In NTFS if you have a file at the bottom of a directory tree like c:\a\b\c\d\file.txt and the file is modified (thereby changing the time/date stamp on the file) is there some way of detecting that by looking at information (err metadata?) in the folder node itself - in other words does NTFS flag a folder as containing items that have changed. Because right now it seems like the timestamp for d\ is fixed at the time it was first created and does not change when its contents change.
We want to write a program that will let us know that we should look in some folder because it knows something changed in there. we want to have to avoid drilling down and looking at the files because there are jazillions of them.
Oh and it needs to be agentless - no tripwire