Are there any negative effects of disabling the Last Access timestamp?

Question

In Windows, you can disable the last accessed timestamp by setting NtfsDisableLastAccessUpdate to 1, for instance by executing this from the command line (the computer must be restarted before it takes effect):

fsutil behavior set disablelastaccess 1

I want to do so there is less disk activity on c:\$logfile.

Might this cause any negative effects or problems?

Solution 1

You wouldn't be able to tell if someone else was reading your files - for example if you had some sensitive data.

I can't think of an OS level command that would need last accessed. Backups check last modified and date created for example. But see @mythokia's answer for one case that might.

Given that it's disabled by default in Windows 7 (thanks @AndrejaKo) and Vista that indicates that (unless there are other changes to compensate) it's OK to turn it off.

I've just thought of a reason why it might be disabled in the new OSes. These have the new Windows Search installed by default. This scans the selected directories for changes and re-indexes new and changed files. This would have written lots of events to the log which might be a reason for disabling it. There's more information on why they stopped updating the Last Access time from Vista onwards in MSDN blog post Why doesn't the file system have a function that tells you the number of files in a directory?.

Solution 2

Some defragmentation programs do use last access as one of the variables of their algorithms. An example would be O&O Defrag.

Comments

[user3660103]

I'm on fresh installation of windows 7 64bit here and NtfsDisableLastAccessUpdate is set to 1 by default.

[ChrisF]

Oh yes - put most recently used files where they're quickest to access. Good point.

[afrazier]

The Search indexer doesn't constantly scan for changes, it uses the NTFS change journal. Otherwise an excellent answer.

[ChrisF]

@afrazier - removed the "continually"

[maaartinus]

You probably should disable it on SSD.

[Synetech]

You wouldn't be able to tell if someone else was reading your files You can’t anyway; in my experience the timestamp is touched from almost every activity, including viewing a directory listing (at least in Windows; dir on a FAT32 volume in DOS does not update it). This renders the attribute effectively useless since it will always report just right now for everything, unless perhaps if you are viewing it “offline” (e.g., through a hex-editor instead of mounted in Windows).

[George Marian]

All you have to do is run regedit.exe, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSyst‌​em and look at the value of NtfsDisableLastAccessUpdate to actually verify. Meanwhile, same created and accessed timestamps suggests that is indeed disabled.

[Inigo]

@maaartinus "You probably should disable it on SSD" Why?

[maaartinus]

@Inigo Because it causes tons of tiny writes and tiny writes cause no less wear than normal writes. Seven years later, the wear is of much less concern.