The last access date is not changed even after reading the file on Windows 7

I have some files on Windows 7, and want to see what time it was that I read it this morning (February 27 morning), but when I right click on the file and choose Properties, I see

Accessed: Yesterday, Feb 26, 2011, 2:12:37PM

so I open the file to read the content again, and then open up the Properties again, and still the Accessed (date) is the same (Feb 26).

Even if I add a column to the folder for "Date Accessed", it still shows Feb 26. But today is Feb 27 and clearly I have "accessed" it... so how can I see the true last accessed date?

nonopolarity

Posted 2011-02-28T05:15:39.720

Reputation: 7 932

Answers

The NtfsDisableLastAccessUpdate registry setting is enabled by default in Windows 7. This was a performance tweak that many people used in earlier OSes because it prevents a lot of excessive writes to the hard drive.

If you actually want the Last Access date updated the way it used to be, simply set the registry value to 0.

For future reference in case the doc link stops working, the key is located in:

HKLM\SYSTEM\CurrentControlSet\Control\FileSystem

It's a REG_DWORD value called NtfsDisableLastAccessUpdate that can be set to 0 or 1.

From the link:

Determines whether NTFS updates the last-access timestamp on each directory when it lists the directories on an NTFS volume.

This entry is designed to prevent the NTFS log buffer in physical memory from becoming filled with timestamp update records. If you have an NTFS volume with a very large number of directories (in excess of 70,000), and Windows 2000 does not respond quickly to dir commands, adding this entry to the registry might make directories list faster.

0 - When listing directories, NTFS updates the last-access timestamp on each directory it detects, and it records each time change in the NTFS log.

1 - When listing directories, NTFS does not update the last-access timestamp, and it does not record time stamp updates in the NTFS log.

Ryan Bolger

Posted 2011-02-28T05:15:39.720

Reputation: 3 351

"...excessive..." Exceeding what, one wonders. – ChrisJJ – 2014-08-16T01:28:09.723

@太極者無極而生 Well, to be honest, any computer data is/should be seen as really wanky evidence in court. Afterall everything can be altered, if not by a normal user, then by a hacker for sure, especially as you can just access the file from another OS and overwrite the data without Windows beeing in your way. – HopefullyHelpful – 2017-03-14T09:06:57.543

2wow... i guess it should not show it when it is actually inaccurate... that can have a lot of confusion such as father talking to the son "I thought you said you looked at the doc this afternoon? I see the last access time being 5 days ago." Or, "I sentence you to 10 years in prison, as clearly you were lying, you said you were home reading that file, but we checked your computer and the last access date of that file was actually 2 months ago. You were lying in court." – nonopolarity – 2011-02-28T06:25:00.113

7Instead of going through the registry, an easier way would be to type this in an elevated command prompt: fsutil behavior set DisableLastAccess 0 – paradroid – 2011-06-21T19:34:04.707

Using this command to enable/disable LastAccessTime :

Open an elevated command prompt. Right click Windows Start button and select Command Prompt (Admin). To check the Last access time updates are enabled or not, run:

C:\> fsutil behavior query disablelastaccess DisableLastAccess = 1

To enable Last access time update:

C:\> fsutil behavior set disablelastaccess 0 DisableLastAccess = 0

To disbale Last access time update:

C:\> fsutil behavior set disablelastaccess 1 DisableLastAccess = 1 After making any change you must restart the computer for the changes to take place.

Luke

Posted 2011-02-28T05:15:39.720

Reputation: 1 044