The “Last Access Time” attribute contains the date and time a file or a folder was last accessed (for reading or executing).
Windows remembers the time when a file was last modified, but to clean up the databases, along with the latest update, it is also useful to know when the files were last displayed. The details of the last access time may be also useful in the computer-forensics.
In Windows XP, it is enabled by default.
In Vista, Windows 7 and Windows 8, the attribute is deactivated by default.
2. Enable and Disable
This manual will show you how to enable or disable the Last Access Time-attribute.
You must login as administrator to be able to perform the steps of this manual.
In an old or slow system, the enabled Last Access Time-Attribute can result in loss in performance through the additional I/O overhead.
2.2. Enable and disable the Last Access Time-Attribute with Regedit
For this, a registry entry needs to be changed and the computer should be restarted.
Enable: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] “NtfsDisableLastAccessUpdate”=dword:00000000
Disable: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] “NtfsDisableLastAccessUpdate”=dword:00000001
After changing the registry-entry, the computer should be re-started.
2.3. Enable and disable the Last Access Time-Attribute on the command level
This command is applicable to Windows Server 2008 and 2012. cmd has to be executed as an administrator.
Enable: fsutil behavior set disablelastaccess 0
Disable: fsutil behavior set disablelastaccess 1
These commands write the registry-entry. Thereafter the computer must be restarted.
3. Display the Last Access Time
You can display the Last Time-Attribute in the Windows Explorer, in which you insert the column “Date accessed” or “Letzter Zugriff” (german) in the column header (by clicking the right mouse button).
You can sort the folders and files in this column as per the Last Access Time. This can be useful when searching.
In the properties of a file, the Last Access Time-Attribute is also displayed in the field “Accessed” or “Letzter Zugriff” (Last Access).