Table of Contents
The "Last Access Time" attribute contains the date and time a file or a folder was last accessed (for reading or executing).
Windows remembers the time when a file was last modified, but it was updated. The details of the last access time may therefore be useful in the computer-forensics.
In Windows XP, it is enabled by default.
In Vista, Windows 7 and Windows 8, the attribute is disabled by default.
2. Enable and Disable
This manual will show you how to enable or disable the Last Access Time attribute.
You must login as administrator to be able to perform the steps of this manual.
In an old or slow system, the enabled Last Access Time attributes can result in loss of additional I / O overhead.
2.2. Enable and disable the Last Access Time Attributes with Regedit
For this, a registry entry needs to be changed and the computer should be restarted.
Enable: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "ntfsDisableLastAccessUpdate" = dword: 00000000
Disable: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "ntfsDisableLastAccessUpdate" = dword: 00000001
After changing the registry entry, the computer should be re-started.
2.3. Enable and disable the last access time attributes on the command level
This command is for Windows Server 2008 and 2012. cmd has to be executed as an administrator.
Enable: fsutil behavior set disablelastaccess 0
Disable: fsutil behavior set disablelastaccess 1
These commands write the registry entry. Thereafter the computer must be restarted.
3. Display the Last Access Time
You can display the Last Time attributes in the Windows Explorer, in which you insert the column "Date accessed" or "Last accessed".
You can choose the folders and files in this column as the Last Access Time. This can be useful when searching.
In the properties of a file, the Last Access Time attribute is displayed in the field. "Accessed"Or "Last Access".