NTFS Last Access Updates
Whether NTFS maintains file last-access times, which decides if you can trust them.
Use it to tell whether file last-access times on this host are reliable for your timeline.
- SYSTEM
- Defence Evasion
What It Is
NTFS, the default file system of modern Windows, keeps a Last Access Time stamp on each file and folder. Windows can turn the updates to that stamp off, which Microsoft says makes file and folder access faster. NtfsDisableLastAccessUpdate, in the FileSystem key of the SYSTEM hive, records whether those updates are on. Even with updates on, NTFS can wait up to an hour before it writes a new Last Access Time to disk.
What It Proves
NtfsDisableLastAccessUpdate decides whether NTFS updates the last-access time when a file is read. When updates are off, last-access times do not move, so they cannot show when a file was opened.
What It Does Not Prove
This changes the meaning of a timestamp, it does not hide a file. Since Windows 10 1803 the default is system-managed and often off on large volumes, so an off value is frequently normal.
Where It Lives
NTFS Last Access Updates lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The policy is user-managed with updates off, set by a person or a tool rather than Windows. Last-access times stop moving, so date the change from the key last write time. |
| System-managed with updates on, the usual default on current Windows. Last-access times move, but NTFS can write them up to an hour late. |
How to Read It
Read NtfsDisableLastAccessUpdate under Control\FileSystem. Even values keep last-access updates on, and odd values turn them off. The 0x8000000x forms are the system-managed defaults. Use the value to decide whether to trust last-access times for the period, and note any change within it.
- When Windows Writes It
- It is written when an administrator, fsutil, or Windows itself changes the policy. It takes effect going forward.
- Which Windows Versions
- Windows XP to 11 (default changed to system-managed in Windows 10 1803)
- Tools That Parse It
- Registry Explorer, RECmd, fsutil query (live)
Hunt It
Defender is not known to record this key. Read it with Velociraptor, or collect the SYSTEM hive and parse it.
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SYSTEM - Parse With
- Registry ExplorerRECmdfsutil query (live)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what NTFS Last Access Updates shows.
- Folders Opened in ShellBagsShows folders the user opened, whatever NTFS does with last-access times.
- RecentDocsShows files the user opened, a record that does not depend on last-access times.
- MFT $STANDARD_INFORMATION TimesNot in the RegistryHolds the last-access times themselves, and this setting says whether to trust them.
Sources
The facts on this page come from these public pages, which say more on each point.