Comments on: Speed Up Disk Access by Disabling Last Access Updating in Windows XP

By: Ralph

Ralph — Thu, 23 Jul 2009 14:10:58 +0000

“Indeed, it looks like a huge waste of the very limited write-cycle resource of today’s SSDs.”

True. And benefit of the performance can be largely felt if you need to access many files at once, like in av-scan.

Those guys earlier claiming that it is useful are pretty wrong in that there are tools which can tell you everything last access date may and MUCH more without needing to read it. It’s called Procmon and it not only can tell you WHEN was the file modified, it can also tell you WHICH PROGRAM did it and WHAT it did specifically
(read, wrote, etc). Also backup programs IMO should NOT rely on last access date but on MODIFIED date instead, since what’s the point backing up exactly the same file OVER and OVER?

By: Max

Max — Sat, 11 Apr 2009 13:20:22 +0000

Most likely Microsoft chose to make this the default setting in Vista not to improve speed but to make Vista more SSD friendly. Indeed, it looks like a huge waste of the very limited write-cycle resource of today’s SSDs.

By: Pro4Life

Pro4Life — Fri, 13 Mar 2009 23:16:21 +0000

@Hoop Last Access Time works like this. For obvious reason Windows will not update the date any time when you open your file but in exactly 1 hour delay. This means that if you open your file in 1.00 PM It will NOT change that value until 2.00PM. It’s default in Windows and I think that time can’t be changed. Looking back into that idea seems good so your hard drive will not go crazy if you open one file too many times in close time frame.

By: Mathew

Mathew — Tue, 11 Nov 2008 23:20:24 +0000

Indeed. Last access is a valuable forensic measurement.

But I like that it is useful for defragging purposes, files that have not been accessed for a long time could be compressed(with NTFS transparent compression) and defraggers could move it to some area on the hard disk.

I do not think the last access time is updated if you just listed the directory, but windows might access the file(open for reading) when its displayed in windows explorer. For example, in thumbnail previews, or if you selected some extra columns(id3 tags for mp3s, other tags for photos, etc.) in windows explorer. You get the idea

I’m not sure about antivirus though,it would be best if antivirus programs do preserve the last access time.

As for performance issues, updating the last access time shouldn’t cause too much of a noticeable performance decrease. Since the time is trivial(probably just a few bytes), doesn’t take a megabyte or two to update. Moreover, windows uses disk caching, it could be the case that windows only writes to the disk when the disk cache is reasonably full.

By: Vladimir

Vladimir — Thu, 07 Aug 2008 12:34:25 +0000

But unfortunately some antivirus programs change this attribute (((

By: Vladimir

Vladimir — Thu, 07 Aug 2008 12:33:51 +0000

And last access time could be great feature if someone wants to defrag drive with clever defrag program or wants to order files in some very old archive.

By: PL

PL — Thu, 27 Mar 2008 14:51:13 +0000

I am having a strange occurance. Bear with me as I try to explain. I want to remove any stale reports that are on a server NTFS share. So I want to use the last access date attribute. However I notice ALL files have the same lastaccess date. Example the attribute shows all files have last access date of 3/22/2005 8:45am. I am unable to find what is causing this lastaccess date. I use symantec antivirus corp edition but I have excluded that folder with these reports from the scan. Then I thought it was the backup agent from HP’s dataprotector. But the back up doesn’t run at that time. I do not most of these files are being access and to boot at the same exact time.

By: jesse

jesse — Mon, 17 Mar 2008 20:51:07 +0000

I have found something interesting, in computer management, under event viewer, it shows that the other computer my computer is networked to logs on and off every 32 minutes. Is it possible the other user can access my computer through the network without me knowing? if so what are the signs of this and how do I stop it?

By: jesse

jesse — Sun, 16 Mar 2008 14:54:31 +0000

@jd2066: But would windows do this the same way every time. It’s been 2 weeks, and everytime I try, my files are accessed at the time the computer comes out of hibernation. just file folders, not documents. It just seems to be to much of a coincidence.
Thank you

By: Hoop

Hoop — Sun, 16 Mar 2008 02:24:00 +0000

@jd2066: Thanks for the reply. My IT dept confiscated the computer and will check everything out. Unfortunately, I think this guy may try to stay one step ahead of them but hopefully they’ll catch him eventually. I think that one file access time was probably a glitch. Thanks again!