Windows Explorer Changing EML Timestamps

Hello folks,

This is something I have been noticing in Windows for a while but just had a chance to track it down. I wanted to share what I’ve found as most of you likely handle loose EML files from time to time.

The Problem

When navigating a folder of EML files on NTFS using Windows Explorer, merely clicking on a file or right-clicking it causes Windows to update the file’s file system last modification timestamp. The file itself is not modified. It is not even launched. Take a look at the video below for a quick demonstration:

What’s Happening?

Looking at the file system after the above exercise reveals the following:

Alternate data streams named OECustomProperty are created for the EML files with which I interacted. Each ADS contains metadata about the email such as sender, recipients, etc. Presumably, the ADS is created by the property system in Windows to help with indexing the file. More info on this here:

The Cure

In my testing, clearing the registry key at the following location and restarting Windows Explorer (or, rebooting the computer) took care of the issue.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.eml

If you decide to do that, do not forget to make a backup of the key first. Also, if you care about Windows’ indexing of EML files, I recommend doing further testing on how this affects indexing.

Here is a relevant community discussion from Microsoft:

1 Like