Can a OneDrive system upgrade change the timestamps of files already stored in OneDrive?

A routine OneDrive service upgrade is not documented as rewriting timestamps on existing files; if dates change near an upgrade, use Version History and Microsoft Purview auditing to determine whether a file-content, metadata, synchronization, migration, or application operation occurred.

Which timestamp changed matters

OneDrive for Business can expose several independent kinds of dates:

• OneDrive/SharePoint service timestamp: The driveItem.lastModifiedDateTime value represents when the item was last modified as seen by the service. This is generally the Modified value displayed on the OneDrive website. A driveItem also has lastModifiedBy, identifying the user, device, or application associated with the last modification.^1^
• Local Windows file-system timestamp: fileSystemInfo.lastModifiedDateTime is supplied by the client and represents when the local copy was modified. Microsoft explicitly states that this can differ from the service timestamp—for example, a file created locally on Monday but uploaded Tuesday can have Monday in fileSystemInfo while the service records Tuesday.^2^
• Embedded document metadata: Office files, photos, and other formats can contain dates inside the file itself, such as document properties or a photo’s date taken. These are part of the content and are separate from OneDrive’s service-level Modified column.
• Folder timestamp: A folder is also represented as a driveItem. Its service or local modified date can change independently of the dates and contents of files inside it.^1^

Consequently, a changed date in OneDrive does not by itself establish that the document’s contents or embedded metadata changed.

Circumstances that can change dates without a deliberate user edit

A timestamp can change even though the user did not manually open and save the file when an operation acts on the item:

1. A property-only metadata update
   An application, workflow, policy, or system account can modify a document’s properties. Microsoft distinguishes an item’s eTag, which covers metadata and content, from its cTag, which does not change when only metadata changes. This allows a property operation to update the item without necessarily changing file content.^1^
2. A background application or synchronization operation
   An Office client, OneDrive sync client, integration, or authorized application can submit an update under a user, device, application, or system identity. In Purview, FileModified explicitly includes modifications to either the content or properties of a document by a user or system account.^3^
3. Content replacement or re-upload
   If content is updated without supplying client file-system dates, Microsoft Graph automatically resets fileSystemInfo.lastModifiedDateTime to the current time.^2^ This can affect both the service-visible date and the local date after synchronization.
4. Migration or bulk transfer
   Migration is an operation, not a routine platform upgrade. Microsoft’s FastTrack file-share migration supports transferring basic metadata including created and modified dates, but preservation depends on the migration path and tool supplying those values.^4^
5. Folder resynchronization or re-creation
   A folder may receive a newer date after being recreated or resynchronized while the files inside retain their previous dates. A similar OneDrive case reports changed folder dates while contained file dates remained intact.^5^

Embedded metadata changes only if a process rewrites the file content or its internal properties. A service-side list-property update does not, by itself, prove that embedded metadata changed.

How to determine what happened

1. Check the same file in both locations
   • In OneDrive on the web, note Modified and Modified by.
   • In Windows File Explorer, right-click the synchronized file and select Properties.
   • If only folders changed, inspect several contained files separately.
2. Review Version History
   • In OneDrive on the web, right-click the file and select Version history.
   • Review versions around the changed timestamp.
   • Open or compare the versions rather than immediately restoring one.
   Version History records when a file or item changed and who made the change; it can also expose property changes.^6^ If content is identical but a new version or property change appears, the event was likely metadata-related rather than a substantive document edit.
3. For administrators, search Microsoft Purview Audit
   • Search the affected time range for FileModified, plus move, copy, upload, or application activity involving the file.
   • Examine UserId, operation time, object path, and application-related details.
   • System and application operations can appear under system identities or app@sharepoint, not necessarily the named end user.^7^

An upgrade occurring at the same time is only correlation. A corresponding version-history or audit event establishes that an operation affected the item; without such evidence, the available documentation does not support attributing the change directly to OneDrive’s service upgrade. If many files changed simultaneously and neither Version History nor Purview identifies a meaningful actor or operation, preserve the timestamps, affected paths, audit export, and sync-client logs, then open a Microsoft 365 support request for backend investigation.

References

1. driveItem resource type
2. fileSystemInfo resource type
3. Audit log activities
4. Data Migration
5. OneDrive just messed up all my pc - Microsoft Q&A
6. Version history overview
7. Detailed activity properties in the audit log