files last accessed
Results 1 to 8 of 8

Thread: files last accessed

  1. #1
    Join Date
    Jul 2002
    Location
    dublin,Ireland.
    Posts
    56

    files last accessed

    Hello

    Could you please tell me if there is any way to see if any files were accessed on my computer while I was away from it. My operating system is Windows xp home. Thanks.
    My System;
    Dell dimension 8100
    P4 1.7ghz x86family15
    60gb hd ide 7200rpm
    512 mb rdram pc800
    nvidia geforce2 ultra
    turtle beach santa-cruz
    altec-lansing ada885 speakers
    19" dell p991 monitor
    samsung dvd/cd rom sd-616 16x
    Lg cd-rw ced-8120b 12x
    hp photosmart p1000
    epson perfection 1240u scanner
    bios version-xp1
    windows xp home
    office xp professional

  2. #2
    Join Date
    Jul 2000
    Location
    Armadillo Country
    Posts
    3,996
    Hi Stuart99,

    I regret to see that your post did not receive a timely reply from our host of fine enthusiasts here at VDr. You can see some information that may be helpful to you, by going to Start, Help and Support. Search on the string:

    files last accessed

    and then choose the link below for fsutil:behavior I hope that this will lead you to some helpful info...

    Happy Computing!

    Limerick

  3. #3
    Join Date
    Jul 2002
    Location
    dublin,Ireland.
    Posts
    56
    Hello limerick,
    thanks for your reply. I typed in "files last accessed" in the search box in the help and support, but there was no links below under the name fsutil:behavior . There where only 2 results found ,glossary
    and files property overview, could you tell me what I'm doing wrong, thanks.
    My System;
    Dell dimension 8100
    P4 1.7ghz x86family15
    60gb hd ide 7200rpm
    512 mb rdram pc800
    nvidia geforce2 ultra
    turtle beach santa-cruz
    altec-lansing ada885 speakers
    19" dell p991 monitor
    samsung dvd/cd rom sd-616 16x
    Lg cd-rw ced-8120b 12x
    hp photosmart p1000
    epson perfection 1240u scanner
    bios version-xp1
    windows xp home
    office xp professional

  4. #4
    Join Date
    Apr 2000
    Location
    Friern Barnet, London, England
    Posts
    46,397
    I don't know why you couldn't fid it - here it is copied from mine anyway:


    Fsutil: behaviorQueries the current settings for generating 8.3 character-length file names, allowing extended characters in 8.3 character-length file names on NTFS volumes, updating the last access timestamp on NTFS volumes, how often quota events are written to the system log, and the size of the master file table (MFT) Zone. Enables or disables the use of 8.3 character-length file names, allowing extended characters in 8.3 character-length file names on NTFS volumes, and updating the last access timestamp on NTFS volumes. Enables you to change how often quota events are written to the system log and to change the amount of disk space reserved for the MFT Zone.

    Syntax
    fsutil behavior query {disable8dot3|allowextchar|disablelastaccess|quotanotify|mftzone}

    fsutil behavior set [{disable8dot3 {1|0}|allowextchar {1|0}|disablelastaccess {1|0}|quotanotify frequency|mftzone value}]

    Parameters
    query
    Queries the file system behavior parameters.
    set
    Changes the file system behavior parameters.
    disable8dot3 {1|0}
    Disables creation of 8.3 character-length file names on FAT- and NTFS-formatted volumes.
    allowextchar {1|0}
    Determines whether characters from the extended character set, including diacritic characters, can be used in 8.3 short file names on NTFS volumes.
    disablelastaccess {1|0}
    Determines whether NTFS updates the last access timestamp on each directory when it lists the directories on an NTFS volume.
    quotanotify frequency
    Configures how frequently NTFS quota violations are reported in the system log. Enter a frequency 0 through 4294967295 seconds for how often quota violations are written to the system log. Default is 1 hour (3600 seconds).
    mftzone value
    The master file table (MFT) Zone is a reserved area that enables the MFT to expand as needed, in order to prevent MFT fragmentation. Set the value from 1 (default) to 4 (maximum). The value is in 8ths of the disk.
    Remarks
    The behavior subcommand writes changes to the registry, so you must restart the computer for changes to take effect.
    Using disable8dot3 {1|0}
    When disable8dot3 is set to 0, every time you create a file with a long file name, NTFS creates a second file entry that has an 8.3 character-length file name. When NTFS creates files in a folder, it must look up the 8.3 character-length file names associated with the long file names.

    This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation registry key.

    Using allowextchar {1|0}
    This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsAllowExtendedCharacterIn8dot3Name registry key.

    Using disablelastaccess {1|0}
    The disablelastaccess parameter is designed to reduce the logging impact of updating the last access timestamp on folders and directories. Disabling the Last Access Time improves the speed of folder and file access.

    Each file and folder on an NTFS volume contains an attribute called Last Access Time. This attribute defines when the file or folder was last accessed, such as when a user lists folders, adds files to a folder, reads a file, or makes changes to a file. The most up-to-date Last Access Time is stored in memory and is eventually written to the disk in two different locations. One is within the file's attribute, which is part of its MFT record. The second is in the index of the directory that contains the file.

    The Last Access Time on disk is not always current. This lag occurs because NTFS delays writing the Last Access Time to disk when users or programs perform read-only operations on a file or folder, such as listing the folder's contents or reading (but not changing) a file in the folder. If the Last Access Time is kept current on disk for read operations, all read operations become write operations, which impacts NTFS performance.

    Note that file-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

    NTFS typically updates a file's attribute on disk if the current Last Access Time in memory differs by more than an hour from the Last Access Time stored on disk, or when all in-memory references to that file are gone, whichever is more recent. For example, if a file's current Last Access Time is 1:00 P.M., and you read the file at 1:30 P.M., NTFS does not update the Last Access Time. If you read the file again at 2:00 P.M., NTFS updates the Last Access Time in the file's attribute to reflect 2:00 P.M. because the file's attribute shows 1:00 P.M. and the in-memory Last Access Time shows 2:00 P.M.

    NTFS updates the index of the directory that contains the file when NTFS updates the file's Last Access Time and detects that the Last Access Time for the file differs by more than an hour from the Last Access Time stored in the directory's index. This update typically occurs after a program closes the handle used to access a file within the directory. If the user holds the handle open for an extended time, a lag occurs before the change appears in the index entry of the directory.

    Note that one hour is the maximum time that NTFS defers updating the Last Access Time on disk. If NTFS updates other file attributes such as Last Modify Time, and a Last Access Time update is pending, NTFS updates the Last Access Time along with the other updates without additional performance impact.

    Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature.

    This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate registry key.

    Using mftzone value
    The value is an approximation of the initial size of the MFT plus the MFT Zone on a new volume and is set at mount time for each file system. As space on the volume is used, NTFS adjusts the space reserved for future MFT growth. If the MFT Zone is already large, the full MFT Zone size is not reserved again. Since the MFT Zone is based on the contiguous range past the end of the MFT, it shrinks as the space is used.

    The file system does not redetermine the MFT Zone location until the current MFT Zone is completely used. This never occurs on a typical system.

  5. #5
    Join Date
    Apr 2000
    Location
    N. VANCOUVER CANADA
    Posts
    1,645
    Typical Microsoft bull
    ** Moderator's edit **

    You ask a simple question you get a not so simple answer

  6. #6
    Join Date
    Jul 2002
    Location
    dublin,Ireland.
    Posts
    56
    Hello super sparks,
    I found all that information in my help support but I was actually looking for something less complicated, as I am a novice. I think changing parameters within fsutil; is best left to advanced users. Should I take it that there is no easy way of knowing if a file has been accessed?
    My System;
    Dell dimension 8100
    P4 1.7ghz x86family15
    60gb hd ide 7200rpm
    512 mb rdram pc800
    nvidia geforce2 ultra
    turtle beach santa-cruz
    altec-lansing ada885 speakers
    19" dell p991 monitor
    samsung dvd/cd rom sd-616 16x
    Lg cd-rw ced-8120b 12x
    hp photosmart p1000
    epson perfection 1240u scanner
    bios version-xp1
    windows xp home
    office xp professional

  7. #7
    Join Date
    Jun 2002
    Posts
    242
    Right-click on the explorer bar where the fields are and select More... then choose "Date Accessed" from the list. This only works for NTFS volumes. You can also use the cmd prompt (dir /ta).
    Don't make me angry... You wouldn't like me when I'm angry.

  8. #8
    Join Date
    Jul 2000
    Location
    Armadillo Country
    Posts
    3,996
    Very helpful, indeed, Mr. McGee!

    Thanks a bunch!

    Limerick

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •