stat[10] is ctime which is literally inode change time. Thing is, in my test at least on Windows this appears to return creation time. On Unix something as simple as moving a file will update this value, as will security related changes like chgrp. not the case on Windows, the value stays the same, and appears to be the actual file creation time.