I’ve installed a program, and all the files the installer created have identical “date created” and “date modified” metadata, indicating the date that the file was last modified by the software’s creator. This information would be correct for the files used to create the installation package, but is technically not correct for the copies of these files on my computer, since those copies did not exist an hour ago.
This creates a problem when I’m attempting to manually identify what exactly this program has installed – e.g. whether it’s created any files outside of its own installation directory.
There are a few possible solutions I can envision, though I don’t know how to accomplish any of them:
- Can I search for files by the date and time that they were first created on the computer I am using, rather than the date in their metadata? For instance, the date and time their record in the NTFS file table was created.
- Can I view a chronological list of recent actions which Windows performed, which would include creation and copying of files?
- Failing that, can I cause Windows to record this date for all files created on my computer’s drives, or copied to them, in the future?
