Use the recording of the last access time on files
The Last Access Time attribute in the Windows File System contains the date and time of the last access (reading or executing) to a file or folder.
Although Windows also remembers the time when a file was last modified. But to clean up your databases, it also makes sense to know when files were last viewed, not just their last change.
Also in computer forensics, specifying the Last Access Time can be useful.
For Windows XP, it is turned on by default.
For Vista, Windows 7, and Windows 8, the attribute is disabled by default.
Enable and disable recording of LastAccessTime on files
This guide will show you how to enable or disable the Last Access Time attribute.
You need to log in as an administrator to follow the steps in this guide.
warning
On an old or slow system, the enabled Last Access Time attribute may cause a performance degradation due to the additional I / O overhead.
Enable and disable the Last Access Time attribute with regedit
This requires a registry entry to be changed and the computer restarted.
Activate: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "NtfsDisableLastAccessUpdate" = dword: 00000000
Deactivate: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem] "NtfsDisableLastAccessUpdate" = dword: 00000001
After changing the registry entry, restart the computer.
Enable and disable the Last Access Time attribute at the command level
This command is applicable to Windows Server 2008 and 2012. To do this, invoke cmd as an administrator.
Activate: fsutil behavior set disablelastaccess 0
Deactivate: fsutil behavior set disablelastaccess 1
These commands write the registry entry. After that the computer has to be restarted.
Display of the Last Access Time
You can display the Last Access Time attribute in Windows Explorer by showing the column “Last Access” or “Date accessed” in the column header (right mouse button).
You can sort the folders and files in this column by the Last Access Time. This can be helpful when searching.
The Last Access Time attribute is also displayed in the properties of a file in the "Last Access" or "Accessed" field.