Last access time to files in the Windows file system - use, activation and display

Use the recording of the last access time on files

The Last Access Time attribute in the Windows File System contains the date and time of the last access (reading or executing) to a file or folder.
Although Windows also remembers the time when a file was last modified. But to clean up your databases, it also makes sense to know when files were last viewed, not just their last change.
Also in computer forensics, specifying the Last Access Time can be useful.

For Windows XP, it is turned on by default.
For Vista, Windows 7, and Windows 8, the attribute is disabled by default.

Enable and disable recording of LastAccessTime on files

This guide will show you how to enable or disable the Last Access Time attribute.
You need to log in as an administrator to follow the steps in this guide.

warning

On an old or slow system, the enabled Last Access Time attribute may cause a performance degradation due to the additional I / O overhead.

Enable and disable the Last Access Time attribute with regedit

This requires a registry entry to be changed and the computer restarted.

Activate: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "NtfsDisableLastAccessUpdate" = dword: 00000000
Deactivate: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "NtfsDisableLastAccessUpdate" = dword: 00000001

Registry entry

After changing the registry entry, restart the computer.

Enable and disable the Last Access Time attribute at the command level

This command is applicable to Windows Server 2008 and 2012. To do this, invoke cmd as an administrator.

Activate: fsutil behavior set disablelastaccess 0

Deactivate: fsutil behavior set disablelastaccess 1

These commands write the registry entry. After that the computer has to be restarted.

Display of the Last Access Time

You can display the Last Access Time attribute in Windows Explorer by showing the column “Last Access” or “Date accessed” in the column header (right mouse button).

Show column for Last Access Time

You can sort the folders and files in this column by the Last Access Time. This can be helpful when searching.

File Explorer

The Last Access Time attribute is also displayed in the properties of a file in the "Last Access" or "Accessed" field.

File Property Last access

Permanent link to this post: https://help.migraven.com/last-access-time-files-windows-file-system-aktivierung/