TechKnowSurge
CompTIA A+ Core 2 1.3 CompTIA A+ Core 2 2.5 CompTIA Server+ 3.3
TechKnowSurge Catalog Videos Moving and Copying Files
VideoComputeFree

Moving and Copying Files

Moving and copying files between folders and drives produces different results for file metadata and permissions. Understanding these behaviors is essential for managing files accurately in Windows environments.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

File move and copy operations in Windows behave differently depending on whether the destination is on the same drive or a separate one. Dragging a file between two folders on the same drive moves it, removing it from the original location without changing its creation date or security permissions. Dragging that same file to a different drive copies it instead, even when no explicit copy command is used, because the file data must be written fresh to the new storage device. Metadata handling differs between move and copy operations in consistent, predictable ways. Moving a file within the same drive updates only the allocation table pointer, so the creation date remains unchanged and NTFS security permissions are preserved. Copying a file, whether to another folder on the same drive or to a different drive, creates a new file instance, which resets the creation date and strips any custom user permissions that were applied to the original. When a file is copied to a different drive, it inherits the permission structure of the destination rather than carrying over the source permissions. This happens because the file is being written as a brand-new object on a separate file system, and Windows applies the destination drive's default security settings accordingly. Read-only attributes are an exception, as they are retained across both move and copy operations regardless of the destination. Recognizing these distinctions matters for file management tasks where accurate timestamps or controlled access permissions are required.

What you'll learn

What's covered

Moving & Copying Files

Aligned to

CompTIA A+ Core 2
1.3 Given a scenario, use features and tools of the Microsoft Windows 10/11 operating system (OS).
2.5 Given a scenario, manage and configure basic security settings in the Microsoft Windows OS.
CompTIA Server+
3.3 Given a scenario, implement group policies and access controls.

Key terms

NTFS Permissions
Access control settings applied to files and folders on Windows NTFS-formatted drives that define which users or groups can read, write, execute, or modify them. NTFS permissions are preserved when files are moved within the same volume but are reset when copied.
File Metadata
Descriptive data associated with a file, such as creation date, modified date, and last accessed date, which may change depending on whether a file is moved or copied.
Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.

Topics

Windows File System Ntfs Permissions File Metadata File Management Windows Administration Operating Systems

Transcript

There's some interesting behavior that happens when we're moving or copying files between folders on the same drive, and between folders on different drives.

The setup

I'm on my demo laptop. I have my two files, file one and file two, here, and I have the same settings set up on these files one and file two. This is on the desktop in this test folder. Then I have the test du, which, as you can see, is on the same drive, and that's open right here. However, I've got this E drive test, so this is on a different drive. I want to show you some of the behavior that happens with these two files.

Moving versus copying

First of all, what I'm going to do is drag this number one over to this test folder, and we can see that it just moves over to the test folder. So it disappears from the original and moves to this location right here.

Now what I also want to do is drag the same file into this E drive test. What we see here is it actually copies it. So if I drag it between two folders on the same device, it just moves it, but if I drag it onto another storage device, it will copy it. That's the first interesting thing.

What we're also going to do is take file two, and I'm going to create a copy of it. I'm dragging it over to the folder right here and I'm going to say copy here, and create a copy there. Then I'll do the same thing down here, so we've got copies on here.

What happens to the timestamps

Let's just take a look at these properties. This is the original — I'm going to take a look at the properties here and what the properties look like. I'm going to do the same thing with this file, which was moved onto the same device, and then file two here, which has been copied onto a folder on the same device, so I'm going to take a look at the properties of that. Then we're also going to take a look at the properties of one of these, which has just been copied over.

Where I'm going with this is what has happened. Our original has these created date, modified date, and the last access. When I move a file or copy a file — here's the file — the created date did not change when we moved the file, but when we copied the file over, now we've got a new creation date. So if we copy files, it creates a new creation date. And then down here we can see the same thing: it's got a new creation date. So when we copy things, it creates a new creation date.

The read-only tag is maintained whether we copy it or we move it. The read only is maintained.

What happens to the permissions

However, let's take a look at security, because I made a change to the security, and the specific change that I made is this example: I added this as a user with permissions on here. So what happens? Well, this is the one that got moved, so this file that got moved maintained those security permissions, but the file that got copied lost that security permission. So security permissions are not copied over.

We can see the same thing on this drive right here. This is on a different drive, and when it gets copied over to the different drive, it actually has some different setup here. We've got this authenticated user, so it has copied it, and now it has the same permissions of the drive that it's on.

Why it behaves this way

Some of the explanation for this behavior is how it gets saved. We have the files that get saved on here, and so the data that actually gets saved in the cluster. Then we have the allocation table. And then perhaps we have other files, such as the permissions file, or maybe some other metadata that is saved. Some of that gets copied over while some of it does not, and so that is part of the explanation.

Some of it's just that it's engineered that way. For instance, if we're moving a file to another folder, and then it is now in another folder, all that's changing is really just this location pointer to it, which would explain why there's not a new creation date for it. However, if we're transferring it to another drive, even if we're just moving it to another drive, all of these bits need to be recreated because it's on a whole other drive, and so that is going to have a different creation date, because now it's created a file and it's brand new on this new drive.

My intention really isn't to get into the details of what all changes and what doesn't change, but you just need to know that when you're moving and copying files, you see certain behaviors depending on what devices you're moving it to and from.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →