[SOLVED] Possible to see when the disk was created / or maybe formatted?

[pntgn]

Hi there,

I wanna know the date I formatted the disk last time, is it possible to see?

Is it possible to see when the disk was created, or maybe formatted?

C: for example.

Windows 10.

 

[ex_bubblehead]

No, that is not possible.

 

[popatim]

Have file explorer set to view hidden and system files.
Now rt click on System Volume Information and check the 'Created' info

 

[ex_bubblehead]

Have file explorer set to view hidden and system files.
Now rt click on System Volume Information and check the 'Created' info

That will only tell the time/date that that specific folder was created. It's not necessarily the same as when the disk was formatted or the filesystem was created as it can be deleted/recreated long after the filesystem was created.

 

[popatim]

Thanks, I forgot the folder could be deleted and windows would just recreate it.
I'm under the belief that all NTFS non-removable drives have this folder created when formatted though.

I suppose we could look at the dates of the master and backup Fat in the meta-data then. $MFT and $MFTxxxx
You'll need a utility to parse the hex though.
@fzabkar would likely recommend DMDE

 

[fzabkar]

I suppose we could look at the dates of the master and backup Fat in the meta-data then. $MFT and $MFTxxxx
You'll need a utility to parse the hex though.
@fzabkar would likely recommend DMDE

You beat me to it.

In fact there is no need to delve into hex. Simply clicking on the Metadata "folder" will display the creation dates of the metafiles, eg $Volume.

BTW, I notice that the creation time of my Windows folder differs from the metadata by 9 hours. I expect this has something to do with time zones???