Here's a screenshot, but a more complete view would be seen by dropping a random file into PropertySystemView.
where are these "properties" stored?
where are these "properties" stored?
I was experimenting with Nirsoft's PropertySystemView and was a bit surprised that it displays many Windows System Properties for even a simple plain text file. I wonder where these properties are coming from. Since it's a plain text file, they aren't stored in the file's primary stream; nor are they in an alternate data stream. Maybe some of them are read from the other "attributes" stored in the file's MFT "file record segment". Or maybe they are generated by Windows Search indexer and stored in and drawn from the index? Or are they generated "on the fly" when PropertySystemView reads the file? Anybody have an idea?
Here's a screenshot, but a more complete view would be seen by dropping a random file into PropertySystemView.
Here's a screenshot, but a more complete view would be seen by dropping a random file into PropertySystemView.
Re: where are these "properties" stored?
From the file system, determined from the filename or from the registry.
System.ComputerName = uses the path to build the computer name (local computer name / remote computer name for \\server\share or mapped network drive)
System.ContentType = uses the extension to get the content type from the registry.
System.DateAccessed = File system.
System.DateCreated = File system.
System.DateImported = ? looks like this is using System.DateCreated.
System.DateModified = File system.
System.Document.DateCreated = Microsoft Office files store this property, looks like it falls back to System.DateCreated.
System.Document.DateSaved = Microsoft Office files store this property, looks like it falls back to System.DateModified.
System.FileAttributes = File system.
System.FileAttributesDisplay = Rendered from System.FileAttributes.
System.FileExtension = built from filename.
System.FileName = File system.
System.FileOwner = File system.
System.FilePlaceholderStatus = File system. (System.FileAttributes)
System.IsFolder = File system.
System.IsShared = From the Registry.
System.ItemDate = ? looks like this is using System.DateModified
Core properties:
https://learn.microsoft.com/en-us/windows/win32/properties/core-bumper
System.ComputerName = uses the path to build the computer name (local computer name / remote computer name for \\server\share or mapped network drive)
System.ContentType = uses the extension to get the content type from the registry.
System.DateAccessed = File system.
System.DateCreated = File system.
System.DateImported = ? looks like this is using System.DateCreated.
System.DateModified = File system.
System.Document.DateCreated = Microsoft Office files store this property, looks like it falls back to System.DateCreated.
System.Document.DateSaved = Microsoft Office files store this property, looks like it falls back to System.DateModified.
System.FileAttributes = File system.
System.FileAttributesDisplay = Rendered from System.FileAttributes.
System.FileExtension = built from filename.
System.FileName = File system.
System.FileOwner = File system.
System.FilePlaceholderStatus = File system. (System.FileAttributes)
System.IsFolder = File system.
System.IsShared = From the Registry.
System.ItemDate = ? looks like this is using System.DateModified
Core properties:
https://learn.microsoft.com/en-us/windows/win32/properties/core-bumper
Re: where are these "properties" stored?
Thanks Void !! (It surprised me to see PropertySystemView list 60 properties for a plain text file!)