Windows

Improve Windows XP Pro's NTFS performance by disabling the Accessed timestamp

If you have an application, such as a search tool, that frequently accesses many files for a simple read operation, the operation required to update each file’s Accessed timestamp can drain your system's performance. Fortunately, you can use disable the Accessed timestamp using the FSUtil command. Here’s how.

The New Technology File System (NTFS) is essentially a huge database that keeps track of all the files on your Windows XP Pro hard disk. When you create a file, or edit and then resave that file, the NTFS creates an entry and records the date in the Created or Modified timestamp so you can access the Properties sheet of the file and check the Created or Modified entries later.

NTFS also creates and keeps track of another timestamp called Accessed. The timestamp lists the date on which the file was last accessed and whether the file was opened and read or changed and saved. Each time NTFS updates a file's Properties sheet, an accompanying disk read/write operation occurs. Since the Accessed timestamp does not add much useful information, you may consider the read/write operation incurred to record it wasteful.

If you have an application, such as a search tool, that frequently accesses many files for a simple read operation, the operation required to update each file's Accessed timestamp can drain your system's performance. Fortunately, you can use disable the Accessed timestamp using the FSUtil command. Here's how:

  1. Open a Command Prompt window.
  2. Type the following command line:

FSUTIL behavior set disablelastaccess 1

If you wish to turn the Accessed attribute back on, simply repeat the command and replace 1 with 0.

Note: This tip applies only to Windows XP Professional.

Miss a Windows XP tip?

Check out the Windows XP archive, and get more hands-on Windows XP tips.

Stay on top of the latest XP tips and tricks with our free Windows XP newsletter, delivered each Thursday. Automatically sign up today!

About

Greg Shultz is a freelance Technical Writer. Previously, he has worked as Documentation Specialist in the software industry, a Technical Support Specialist in educational industry, and a Technical Journalist in the computer publishing industry.

29 comments
Jaqui
Jaqui

the logged date-time stamp that can help you to identify a successful intrusion to your system. after all, if the files are accessed when the system isn't legitimately being used by anyone it's not an issue is it. not knowing your client data has been stolen is a good thing.

g.a.leijenaar
g.a.leijenaar

There is no command prompt in accessories. Where is it located?

mike_flood
mike_flood

Does this "go away" when you re-boot?

kenh99
kenh99

Would disabling this affect, slow down or otherwise screw up other operations like backups that look for changed files? File Synchs that look for different versions of same files? Etc? Ken

seanferd
seanferd

Thanks for pointing out fsutil!

jimdandy45
jimdandy45

Would this significantly improve performance on a full system anti-virus or spyware scan? It currently takes me about 2 and 1/2 hours for a full scan using AVG free version, and I'd like to reduce that some. I'll have to do a test doing it both ways.

tony.serratore
tony.serratore

It's even easier with this script -- save into notepad and save as .reg ------ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] "NtfsDisableLastAccessUpdate"=dword:00000001

aboo_alfadel
aboo_alfadel

thanks very much ,but I didn't understand the syntax,of the command , it is different from registry commands.

hhoffman
hhoffman

It looks like you can do this in XP home version also.

g.a.leijenaar
g.a.leijenaar

There are two possibilities for the Home Edition: (but only, if you trust yourself to edit the registry) 1. Start, Run and type Regedit:navigate to: HKEY CURRENT USER/Software/Microsoft/Windows/ CurrentVersion/Policies/Explorer: Rightclick in the right column,choose New, then Dword-value and name it: NoInstrumentation,doubleclick on it and give it a value 1,close and restart. 2. Start, Run and type Regedit: navigate to: HKEY LOCAL MACHINE/System/CurrentControlSet/ Control/FileSystem: Rightclick in the right column, choose New, then Dword-value and name it: NtfsDisableLastAccessUpdate, doubleclick on it and give it a value 1, close and restart. Lots of success! g.a.leijenaar@terra.es

wescrook
wescrook

....actually, if you use the registry fix as posted above, it won't take effect UNTIL you reboot, but unless you switch the registry back, it will stay permanently changed.

seanferd
seanferd

Last Accessed Time is different from the Modification Time, which is what you are interested in when doing differential backups (backing up only files that have changed since the last backup). Backup or synch should also be checking actual file content, anyway. It also has nothing to do with version information. The folks who are interested in Access times are those who may be checking for unauthorized file access. In a network scenario, there is also other information stored to assist with this (like which user accessed it). Edit: There may be software that relies on this, I suppose, but that would indicate to me some poorly designed software. Unless you use a disk defragmenter that optimizes file placement by recent and/or frequent use (usually because you set it up that way), I wouldn't worry about it. *And for Pete's sake, no, I wouldn't do this on a corporate network. "Duh", as one may say. If you are administering a net and you are asking these questions, you are obviously going to have bigger problems than worrying about access times. Admins will know what they should do here, I would hope. I would suggest that the home user might do this for a small tweak, if they generally know what they are doing, and want to mess around with it.* Fsutil subcommands Straight from MS. If you try it and backups don't work right for you (test it), just turn it back on.

rkorb
rkorb

Interested in knowing the results of the anti-virus test w/ resp to disabling the access date. If each file test during an av or spyware scan counts as an access then disabling the last access date sounds interesting - What would be nice would be to have software that disables it for those scans and then re-enables it for everyday use...

icmp30
icmp30

I'd be surprised if the backup software even looked at the last access time - why would it care about the last time a file was read? I've had the last access timestamp disabled for ages & haven't noticed any problems. The archive flag and the date modified timestamp are still updated when the file is written to so the 'save all files that have been changed' & 'save all files that have been changed since ' functions continue to work.

DNSB
DNSB

Around here, it was used to decide whether to migrate a file to backup storage based on the file not having been accessed in 8 weeks. When a couple of our engineers set their computers to not update the last accessed stamp, we started moving their files offline though they were actually being used. A bit of fun finding out why this had happened.

Oldmanmike
Oldmanmike

From Microsoft (http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/fsutil_behavior.mspx?mfr=true): "Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature." Maybe this is a handy tool during certain times when you're wanting to beat up the disk(s), but I'd think you'd want to re-enable this so your backups wouldn't be impacted. Seems like something that might be handy in the server realm at certain times, too. Again, I would want to make sure it's usually on.

Day-by-Day
Day-by-Day

File synchs, backups, etc. check for the file modified date or the archive bit. The file accessed date is a file header attribute, not a file content attribute, and should not affect file synchs, backups, etc.

Craig_B
Craig_B

I have the same concerns. I think there may be cases where you would want to know the last access time. I'm sure if you disable this you will find out :)

pointzerotwo
pointzerotwo

If you get a chance, please post your results.

seanferd
seanferd

It isn't a registry command per se, the syntax is for fsutil only. You can find the Microsoft documentation here: Fsutil subcommands Enjoy :)

RLCF
RLCF

Thanks, DNSB. Your post clarified the whole topic for me by showing what the last accessed date is actually used for.

Photogenic Memory
Photogenic Memory

I read the link you posted from the MS support site. I liked it. It did expressly state this at the end;: "Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature." which is something that's very important. Are the advantages of disabling last access timestamps that advantageous? Just how much faster will things work? Also what about security concerns in logging in eventvwr? It's probably best to leave this alone unless something drastic is needed which is exactly when? I would love an answer as to why this would be implemented on a production server? I don't think it would be wise, period!

ms
ms

One would think that (good) backup software would look at the date and time a file was modified, rather than accessed. Agree? I agree with you though Mike, it'd be good to know when last a file was accessed. Edit: It will affect the XP Disk Cleanup utility (if one uses it), because it looks at when files were last accessed.

vasboz
vasboz

I agree with you and a lot of users will I believe find it slightly more difficult without but I don't use that as I enjoy the NAME, SIZE TYPE columns only, this also wouldn't stop the Date Created column... so there is still some history... unless ofcourse you keep a lot of copies of files with similar/same names scattered in a system where dates become of big concern as far as last accessing it.

davidcurtis014
davidcurtis014

I disable this attribute on all my machines from Win 2K to Vista. This attribute is obviously misunderstood. It has nothing to do with resetting the archive bit used by backup utilities that need to do incremental backups. It also has NO effect on full backups. It has nothing to DO with backups whatsoever. The Microsoft site warns: "Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature." but note that it says "can affect" and not "affects", also note that it says "programs such as backup and Remote Storage". These two terms are non-specific. There is no program specifically called "Backup" and no program specifically called "Remote Storage". Thus what Microsoft is saying is that "There is a POSSIBILITY that your backup utility or remotes storage utility MAY be affected IF they are programmed to notice or care whether Last Access is running on your computer." I have been running two backup programs for years and not once have I had to deal with any issues involving disabling Last Access. What Last Access is for is in case a computer is a member of a domain (In other words, the computer logs on to a domain with a domain server present) and IN CASE the administrator wants to audit file access by these computers on the domain. Most administrators never do it. The "Last Access" attribute only slows down the system if it's not used - and if the computer in question is not a) logged in to a domain AND b) having file access monitored by the server THEN you don't need it - it only slows things down.

Photogenic Memory
Photogenic Memory

Like I said before which is confirmed at the Microsoft site; disabling this attribute is kinda risky. It leaves too much up in the air just so you can have a faster(how many seconds?)drive. It's really non-essential.

SB-IT
SB-IT

It seems to me you'd want to be able to see "the date on which the file was last accessed and whether the file was opened and read or changed and saved". For any machine on my network I'd want the ability to retrieve this information for auditing purposes if nothing else.