Last access time - find old, unused data

1. Use

The "Last Access Time" attribute contains the date and time a file or a folder was last accessed (for reading or executing).
Windows remembers the time when a file was last modified, but it was updated. The details of the last access time may therefore be useful in the computer-forensics.

In Windows XP, it is enabled by default.
In Vista, Windows 7 and Windows 8, the attribute is disabled by default.

2. Enable and Disable

This manual will show you how to enable or disable the Last Access Time attribute.
You must login as administrator to be able to perform the steps of this manual.

2.1. warning

In an old or slow system, the enabled Last Access Time attributes can result in loss of additional I / O overhead.

2.2. Enable and disable the Last Access Time Attributes with Regedit

For this, a registry entry needs to be changed and the computer should be restarted.

Enable: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "ntfsDisableLastAccessUpdate" = dword: 00000000
Disable: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "ntfsDisableLastAccessUpdate" = dword: 00000001

Registry entry

After changing the registry entry, the computer should be re-started.

2.3. Enable and disable the last access time attributes on the command level

This command is for Windows Server 2008 and 2012. cmd has to be executed as an administrator.

Enable: fsutil behavior set disablelastaccess 0

Disable: fsutil behavior set disablelastaccess 1

These commands write the registry entry. Thereafter the computer must be restarted.

3. Display the Last Access Time

You can display the Last Time attributes in the Windows Explorer, in which you insert the column "Date accessed" or "Last accessed".

Data Accessed

You can choose the folders and files in this column as the Last Access Time. This can be useful when searching.

File Explorer

In the properties of a file, the Last Access Time attribute is displayed in the field. "Accessed"Or "Last Access".

File Property Last access

Permanent link to this post: