This trick can be useful if you think someone or something (malware) other than you might be using your computer. Or perhaps you’re a forensics corp IT guy? Anyway, a few things to keep in mind before we get started:
- Enabling or Disabling this won’t make your Accessed date vanish or reappear, rather it will only change if Windows updates the timestamp or not.
- If a last accessed timestamp already exists for your file, it will remain persistent unless this feature is enabled. Once enabled, however, all of your apps will become aware of when they are being used/accessed.
How to Add Access Time Stamps to All Files on Windows 7
Click Start and then search for cmd. Once that comes up right-click cmd.exe and select Run as administrator.
When the UAC prompt appears click Yes.
Now in the cmd prompt, Type in “ fsutil behavior set disablelastaccess 0 “ and press Enter.
Restart your PC for changes to take effect. Now timestamps are enabled, and you’ll be able to see when files are accessed from now on. Take note on really old PCs this might cause performance issues, but even that isn’t too common. Okay, now we’ll look at the other side. Maybe you have Time Stamps enabled, but you are ready to give them the boot. How To Disable Last Access Time Stamps In Windows 7 Open the cmd prompt from administrator mode like before, but this time type in “ fsutil behavior set disablelastaccess 1 “
How To Use Last Access Time Stamps In Windows Search Results
Manually looking through the properties of every file on your system could take years. This scenario is where Windows Search comes into use. Using Search + Timestamps you’ll be able to sort by access date and see exactly what went down on your PC, exactly when it all happened, and sometimes even in what order.
In the Start Menu search area, Type * and press Enter. Searching for a * sign signifies that Windows Search should pull up every single file on your computer. The ‘See more results’ button is another great way to get into the searching mood.
Switch the Window view to Details.
Right-click the category bar and click More.
On the next window scroll down and check the box for Date Accessed and then hit OK.
Now when you do Windows searches, it will display the “Date accessed” category and you can organize it better than this picture by just clicking the Category name.
Comments or suggestions? Post it below or join the discussion in the groovyPost community forum! Nice job ms…. I was actually trying to use the last accessed date, when I found that it was disabled. I followed the directions (including the reboot) but my accessed date still doesn’t change as expected. I have a test file that I “type”ed out (cmd prompt) in the command line, loaded into two editors (notepad, notepad++, opened file, closed file, no changes). I thought it was not working at all, then I see that it did update the last accessed time. I tried again and 20 mins later, there is still no update to this data. I even closed all my windows explorers and reopened one, still no change. Very odd. I suspect that MS shipped this feature disabled because it doesn’t work in a reliable way. Folks might want to reconsider turning this on, given that it doesn’t produce reliable results. Shame I could really use it Thanks for the info, perhaps MS will patch this in a SP. http://social.msdn.microsoft.com/Forums/en-US/netfxbcl/thread/784cfb4e-515c-497f-a593-4c68bfa1cec8 States: Depends on the file system type I guess. For example, the last write time is not fully updated until all handles that are used for writing are closed, and NTFS candelays updates to the last access time for a file by up to 1 hour after the last access, or not at all if HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate is enabled. So updates for the last access time can be delayed by up to an hour. For example, if you work from 9am-5pm. You’ll know that most files probably shouldn’t have been accessed between that time, so if you see a file accessed during that time in the search results you should probably inspect what is causing it. Thanks in advanced. Back then, computers were mainly HDD-based, and HDD-s are notoriously slow when it comes to random access. However, given that the update would happen while the file is read anyway, it’s at least possible to optimize it, so it happen in one pass. Now, more and more computers have SSD-s, and large amounts of tiny writes actively degrades the flash memory that SSDs are based on. SSD-s can do tiny random reads at blazing speeds, but it is the nature of flash memory that a tiny overwrite causes rewriting of a whole page. And writing is what degrades an SSD. Comment Name * Email *
Δ Save my name and email and send me emails as new comments are made to this post.
