External hard drives: 'date last accessed' file?

Question

I'm trying to figure out if there's a way to figure out when files on my external hard drive were last opened. I'm using a Seagate Backup Plus, and it's both mac and PC compatible. BUT, I've also read that updating of the 'accessed' date is usually turned off by default on these drives to save space. This seems to be the case, because when I checked it on my mac the dates it gave me under 'date last opened' appeared to be when the files were created, not when I last opened one (ran one as a test case). Does anyone have any suggestions? Thanks in advance for your help.

Answer 1

They aren't turned off to save space, but rather because it results in an unnecessary amount of writes when you are reading a large number of files. You can view the various timestamps entries both on Windows and Linux, as outlined in this answer. I am assuming you are using either Windows or Linux.

Window with NTFS

Windows uses MACE for timestamps on files, meaning Modify, Access, Create, and Entry modified. On Vista systems and later, access times are disabled by default via a default registry value of 1 for NtfsDisableLastAccessUpdate. When this is the case, the access time will only be updated when the file is created or modified, making it unreliable for determining the dates of last access.

You can re-enable access times by toggling the registry value or by using the following command:

fsutil behavior set disablelastaccess 0

Linux with ext4

Linux uses MAC for timestamps on files, meaning Modify, and Access, Change, often called mtime, atime, and ctime, respectively. The difference between mtime and ctime is subtle here. The mtime is only updated if the contents of the file are modified, whereas ctime is updated if either the contents or metadata are modified. Many Linux systems use a mount option called noatime which disables access time updates. The atime will only be updated when the mtime or ctime change. There is also the common relatime mount option, which updates the atime only if the previous access was earlier than the current ctime or mtime. It is used to reduce unnecessary disk writes while still preserving some information about accesses.

A small triviality is that modern ext4 filesystems have an additional two timestamps which are not available to userspace by default: crtime (creation time) and dtime (deletion time). The dtime is obviously only present in deleted inodes and has an unclear purpose, and the crtime is just not displayed for legacy reasons.

You can temporarily re-enable access times using the following command:

mount -o remount,strictatime /path/to/mountpoint

Permanent changes require editing fstab(5).