File Accessed Date

[goombawaho]

If you right click a file and choose properties, the "Accessed Date" is always right when you just right-clicked.

How could you find out when it was accessed BEFORE the right click without having that date updated?

Is it possible to boot up to another operating system (Linux or BartPE) and see the accessed date without updating that date (like in Windows) to today's date??

If you could do that in Linux, would the file "know" it had been accessed once booted into Windows again?

 

[Turkbear]

Hi,
If you move to Windows 7 it does not work that way..It shows the actual last accessed time and date.





To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[linney]

If you choose "Accessed" in View/ Choose Details, and if you also select View/ Details when using Explorer, does it provide a list of sub folders and files with an earlier accessed date than the present time and date?

 

[cmeagan656]

If you change your Windows Explorer view to "Details" and include "Date accessed" as one of the details then you should be able to see the date that the file was accessed without clicking on the file itself.

Hope this helps.

Please help us help you. Read Tek-Tips posting polices before posting.
Canadian members check out Tek-Tips in Canada for socializing, networking, and anything non-technical.

 

[goombawaho]

Linney - I didn't understand what you were saying. Was it similar to what cmeagan656 was saying??

For example, I have ALL MY FOLDERS set to DETAILS under VIEW by going into one folder setting VIEW DETAILS and then doing TOOLS, FOLDER OPTIONS, VIEW, Apply to All Folders.

ACCESSED is not an attribute that shows up in that view. The only way that I know of seeing the accessed date is by right-clicking the file.

Am I being dumb??? Oh wait - yes I am being dumb. You CAN choose the ACCESSED option by going into MORE.

So, you can turn on viewing of that attribute and then you can see in the folder when it was accessed without "poisoning" the result by right-clicking.

 

[goombawaho]

No wait - that doesn't work. Just turned on "Accessed" in one folder view and it shows all the file accessed dates as NOW.

 

[goombawaho]

I just tried it on a PC booted up to BartPE and the same thing happens after you right click the file and go to properties. It shows the time of day you did the right-click.

Then I rebooted the PC into BartPE again and the "accessed" time stamp was still there, so it is permanently stamped apparently.

Can anyone answer my question though on how to avoid the update and look at the LAST time accessed?

 

[Turkbear]

Hi,
I found this:

http://www.computing.net/answers/windows-xp/last-accessed-date/38080.html[/URL]]
TEG August 27, 2002 at 07:33:28 Pacific


--------------------------------------------------------------------------------
This might be of help, assuming you are using NTFS.

[Start] [Run] [Regedit]
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Modify/Create the Value Data Type(s) and Value Name(s) as detailed below.
Data Type: REG_DWORD [Dword Value] // Value Name: NtfsDisableLastAccessUpdate
Setting for Value Data: [0 = Suppression Disabled / 1 = Suppression Enabled]
Exit Registry and Reboot

However, that might prevent ANY update to that date, which may not be what you want.



To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[linney]

This is what I mean, see link to get to image.

http://lipbhq.bay.livefilestore.com...Zzhspk6haksDaz3mSOb4ftI9OafqfmOx0n/CHOOSE.jpg

1. Choose Deatails.
2. Details.

 

[Glenn9999]

However, that might prevent ANY update to that date, which may not be what you want.

It will. This setting prevents the writing of last accessed date to NTFS volumes, which is a major performance enhancement along with setting the drive to not write 8x3 names. I set this on all the machines I've worked on in XP. I understand it's a major enough enhancement that Microsoft sets this by default in Vista and Seven.

It is not possible for anyone to acknowledge truth when their salary depends on them not doing it.

 

[goombawaho]

Linney - that's what I already figured out although I didn't understand your post, I had already done it shortly after your post.

But, nothing mentioned gets me the desired results. In other words, I couldn't tell if someone was snooping on someone's PC because the file accessed date will be "polluted" by today's date when looking at the accessed date.

Sort of an infinite loop. Maybe there's no way to do it.

 

[linney]

Does any file you are interested in get "polluted" if you look at it from the parent folder in the Details View?

If you want to start at the C: drive and browse down through the child folders you may have to set the view (Details) to apply to all folders via Folder Options.


What about this different tact? Maybe it is too cumbersome, see what you think?

How to audit user access of files, folders, and printers in Windows XP

http://support.microsoft.com/kb/310399

Auditing Access to Files

http://www.gregthatcher.com/Papers/IT/audit.aspx