Are there any negative effects of disabling the Last Access timestamp?

Question

In Windows, you can disable the last accessed timestamp by setting NtfsDisableLastAccessUpdate to 1, for instance by executing this from the command line (the computer must be restarted before it takes effect):

fsutil behavior set disablelastaccess 1

I want to do so there is less disk activity on c:\$logfile.

Might this cause any negative effects or problems?

Related discussion for Linux: https://en.wikipedia.org/w/index.php?title=Stat_%28system_call%29&oldid=511345005#Criticism_of_atime — Mechanical snail, Sep 08 '12 at 08:25
[Starting with Windows Vista, last access timestamping is disabled by default](https://blogs.technet.microsoft.com/filecab/2006/11/07/disabling-last-access-time-in-windows-vista-to-improve-ntfs-performance/) *([archive](https://archive.fo/RRftu))* — Ian Boyd, Apr 19 '18 at 15:08

score 13 · Accepted Answer · edited Jul 17 '22 at 16:09

13

You wouldn't be able to tell if someone else was reading your files - for example if you had some sensitive data.

I can't think of an OS level command that would need last accessed. Backups check last modified and date created for example. But see @mythokia's answer for one case that might.

Given that it's disabled by default in Windows 7 (thanks @AndrejaKo) and Vista that indicates that (unless there are other changes to compensate) it's OK to turn it off.

I've just thought of a reason why it might be disabled in the new OSes. These have the new Windows Search installed by default. This scans the selected directories for changes and re-indexes new and changed files. This would have written lots of events to the log which might be a reason for disabling it. There's more information on why they stopped updating the Last Access time from Vista onwards in MSDN blog post Why doesn't the file system have a function that tells you the number of files in a directory?.

edited Jul 17 '22 at 16:09

Glorfindel

4,089
8
24
37

answered Oct 16 '10 at 16:22

ChrisF

41,278
17
101
154

2

I'm on fresh installation of windows 7 64bit here and NtfsDisableLastAccessUpdate is set to 1 by default. – AndrejaKo Oct 16 '10 at 16:30
The Search indexer doesn't constantly scan for changes, it uses the NTFS change journal. Otherwise an excellent answer. – afrazier Oct 16 '10 at 19:44
@afrazier - removed the "continually" – ChrisF Oct 16 '10 at 20:01
3

You probably should disable it on SSD. – maaartinus Apr 24 '11 at 16:39
`You wouldn't be able to tell if someone else was reading your files` You can’t anyway; in my experience the timestamp is touched from almost every activity, including viewing a directory listing (at least in Windows; `dir` on a FAT32 volume in DOS does not update it). This renders the attribute effectively useless since it will always report *just right now* for everything, unless perhaps if you are viewing it “offline” (e.g., through a hex-editor instead of mounted in Windows). – Synetech Aug 19 '13 at 20:39
@maaartinus "*You probably should disable it on SSD*" Why? – Inigo Oct 04 '18 at 13:38
@Inigo Because it causes tons of tiny writes and tiny writes cause no less wear than normal writes. Seven years later, the wear is of much less concern. – maaartinus Oct 04 '18 at 15:39

score 9 · Answer 2 · edited Sep 08 '12 at 08:19

9

Some defragmentation programs do use last access as one of the variables of their algorithms. An example would be O&O Defrag.

edited Sep 08 '12 at 08:19

Peter Mortensen

12,090
23
70
90

answered Oct 16 '10 at 17:14

sheepbrew

403
4
8

Oh yes - put most recently used files where they're quickest to access. Good point. – ChrisF Oct 16 '10 at 17:17

score -2 · Answer 3 · answered Jan 20 '15 at 16:41

Don't know about negative effects, but some of these answers are just plain wrong (namely, ChrisF's and Synetech's).

Proof:

my desktop's desktop.ini file, for instance, has different timestamps for all entries (created, modified and accessed), while other files in the same folder have either the same timestamps for all entries, or just for 2 entries (e.g.: same created and accessed timestamps, different modified timestamp (typically, dl'ed files));
performing a dir command on my desktop folder doesn't change any timestamp;

So:

in (my) Windows 7 (x64 sp1), last access timestamp is not disabled;
dir does not touch timestamps on NTFS, either;

All you have to do is run regedit.exe, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem and look at the value of NtfsDisableLastAccessUpdate to *actually* verify. Meanwhile, `same created and accessed timestamps` suggests that is indeed disabled. — George Marian, Aug 08 '15 at 16:52

Are there any negative effects of disabling the Last Access timestamp?

3 Answers3

Linked