Hi Hedde,
Normally, HCI_createdDateString should be equivalent to "Created" or "Date created" in Windows properties because this would make most sense and a customer would expect to get this information mirrored in HCI. But this is not the case. The reason for this is that we need to use Samba client to get an SMB connection to an NTFS filesystem. Linux is using not "Created" but "Changed" attributes for files it sees on its mount points as you can see from the below screenshot.
"Birth" would be the timestamp which should contain the "Date created" or "Created" property from the file on the Windows server. But it doesn't because it is not transferred by the Samba client we use. Hence HCI is not able to present the correct "Created" timestamp. Instead HCI is using the "Change" attribute for HCI_createdDateString, which is honestly said, not correct. But there is no other possibility for HCI (at least with this method we have to use for a CIFS connector) to determine the correct value from Windows. So, in an HCI search result you'll only find the correct attributes if a file has never modified or copied. But how often do we have this? HCI_createdDateString will be mostly == HCI_modifiedDateString or newer that HCI_modifiedDateString in case the file has been copied after the last modification.
The only alternative would be to have a native NTFS connector into SMB shares. But this is something PM would answer with "This can be developed by using the HCI SDK". Not sure if the mindset has changed in meantime and it is on the roadmap for next future.
Hope this helps and I'm not wrong ;-)
Brgds,
Ecky