File Last Accessed

File Last Accessed

If you right click on any file, you can see the File Last Accessed value under the General tab. The problem is, that might not be up to date or might even report the 1st of January 1970 as last access date, even when you open and close the file.

FileLastAccessed_not_updating

Now that isn’t a great start if you want to audit files not accessed in a long time frame. That would be extremely helpful for File Servers as you would be able to provide reports to the Share’s owners. This will help them choosing the files that can be archived/deleted.

The reason why this is not updating by default is due NtfsDisableLastAccessUpdate [HKLM\SYSTEM\CurrentControlSet\Control\FileSystem] registry key that is set to 1 to prevent excessive writes to disk. This is Microsoft’s description about this REG_DWORD:
0: When listing directories, NTFS updates the last-access timestamp on each directory it detects, and it records each time change in the NTFS log.
1: When listing directories, NTFS does not update the last-access timestamp, and it does not record time stamp updates in the NTFS log.

Setting this key to 0 will allow the OS to start capturing the last accessed property. Another way to disable this registry key is running the following command with elevated rights:

fsutil behavior set DisableLastAccess 0

In Microsoft’s words: Because updating the last-accessed timestamp requires writing data to the disk, an activity that accesses many files might be faster if this type of update is disabled.
I searched a bit more and also found out a user who noticed a 6% performance increase when this key was set to 1. When NtfsDisableLastAccessUpdate was set to 1, the backup took 5 hours and 45 minutes, when it was set to 0 it took 6 hours and 7 minutes (200GB worth of data).

IT Droplets

IT Droplets