Have you ever created a file in Windows and noticed that its creation date doesn’t seem to match when you actually made it?
It sounds like a simple Windows glitch. But there is a surprisingly old explanation for it.
Windows has a feature called File System Tunnelling that can cause a newly created file to inherit certain metadata from a file that was recently deleted or renamed. The behavior is intentional and dates back to much older versions of Windows.
That means a completely new file can sometimes appear to have been created much earlier than it actually was.
A new file can inherit an old creation date
Imagine you have a file called report.txt.
You created it yesterday and then delete it. A few seconds later, you create another report.txt in the same folder.
When you check the new file’s Properties, Windows may show yesterday’s creation date rather than today’s date.
The new file isn’t actually the old file, and its deleted contents haven’t somehow returned.
Instead, Windows can temporarily retain some metadata associated with the deleted or renamed file and apply that information to a replacement file with the same name.
This behavior is known as File System Tunnelling.
Microsoft’s documentation explains that NTFS-formatted drives can temporarily cache file metadata, including creation time, as part of this process.
What exactly is Windows remembering?
The important distinction is that Windows isn’t preserving the deleted file’s contents.
It is preserving selected pieces of file metadata.
That can include:
- The original creation timestamp
- Long filename information
- The relationship between long and 8.3 short filenames
The cached information is temporary. The mechanism is associated with a short time window, commonly described as around 15 seconds, rather than something that remains indefinitely.
So if you delete a file today and create a similarly named file next month, you shouldn’t expect Windows to suddenly give the new file the old timestamp.
Why would Microsoft design Windows this way?
This is where the behavior becomes much more interesting.
It wasn’t primarily designed to confuse users about file dates.
Instead, File System Tunnelling helps Windows accommodate the way applications save files.
When you edit a document and hit Save, an application doesn’t necessarily overwrite the original file directly.
Some applications use a technique often described as a safe save.
The process can look something like this:
- The application creates a temporary replacement file.
- It writes the updated contents to that file.
- The original file is deleted.
- The temporary file is renamed to the original filename.
From the user’s perspective, nothing unusual happened. You simply edited report.docx and clicked Save.
Internally, however, the filesystem may have seen a file being created, another one being deleted, and a replacement being renamed.
Without tunnelling, that replacement could potentially appear to have a completely new creation timestamp.
It also solved an older filename problem
There is another historical reason for the feature.
Older Windows and DOS-era applications relied heavily on 8.3 filenames, where a long filename was associated with a shorter DOS-compatible name.
For example, a modern filename such as:
My Important Document.txt
could have an older-style short representation.
File System Tunnelling helped preserve the relationship between those long and short names when files were replaced or renamed.
That made the behavior particularly useful for maintaining compatibility with older software.
In other words, a feature that may look strange on a modern Windows 11 PC has roots in problems Microsoft needed to solve decades ago.
Windows has a temporary “memory” for deleted or renamed files
The tunnelling mechanism uses a temporary cache.
According to Microsoft’s documentation, the relevant operation combinations include scenarios such as:
- Delete a file and create another with the same name
- Delete a file and rename another file to its name
- Rename a file and create another using its previous name
- Rename a file and rename another file to that name
This explains why simply creating a file with the same name isn’t enough in every situation.
The timing and sequence of filesystem operations matter.
It’s not the same as recovering a deleted file
There is an important misconception worth clearing up.
If Windows gives your new file an old creation date, it doesn’t mean the deleted file has been restored.
The contents of the old file aren’t being transferred to the new one.
The tunnelling mechanism deals with selected metadata.
Microsoft’s NTFS documentation separately explains that each file has an entry in the filesystem’s Master File Table (MFT), which contains information such as timestamps and other file information. When files are deleted, their MFT entries can eventually be reused.
So seeing an old timestamp should not be interpreted as evidence that Windows secretly recovered the deleted document.
Why you probably don’t notice it often
For most Windows users, this behavior is practically invisible.
The conditions have to line up: a file needs to be deleted or renamed, another operation needs to happen with the relevant name, and it needs to occur within the short tunnelling period.
That’s why you might encounter the behavior occasionally but never see it during normal everyday file management.
It can be particularly noticeable when troubleshooting applications that frequently use temporary files or when testing filesystem behavior.
A decades-old Windows trick still exists today
What looks like a bizarre Windows 11 timestamp bug is actually an example of backward compatibility influencing modern Windows.
File System Tunnelling was created to solve practical problems involving applications that replaced files rather than modifying them directly, as well as compatibility with older filename conventions.
The result is a small piece of Windows behavior that can still surprise users decades later.
So, if a brand-new file suddenly claims it was created yesterday, Windows may not have got the date wrong at all.
It may simply be remembering a file that was there before it.
Final thoughts
Windows has accumulated countless compatibility features over the years, and File System Tunnelling is a perfect example of one that most users will never know exists.
It also explains why judging a file’s history solely by its creation timestamp isn’t always as straightforward as it seems.
A file can be genuinely new while still carrying metadata inherited from a previous file with the same name.
And yes, the feature has an unusually appropriate name: File System Tunnelling.
Microsoft engineer Raymond Chen previously explained the mechanism on Microsoft’s The Old New Thing blog, including the historical reasoning behind the feature.
For the latest rollout updates and troubleshooting guides, follow our Windows 11 coverage as more details emerge.
