A
AnyBody43
Hello,
I am puzzled by the meaning/use of the field last accessed date in NTFS.
I wish to use it for data archiving but can't find out when the field is altered.
Opening the file does NOT seem to change the "accessed" time stamp.
What is it for? From the observed behaviour accessed seems to mean the
same as modified? This makes no sense - to me.
I have done a bit of searcing but can find nothing useful.
C:\test1>dir
Volume in drive C has no label.
Volume Serial Number is 0513-E435
Directory of C:\test1
10/11/2004 12:40 <DIR> .
10/11/2004 12:40 <DIR> ..
10/11/2004 12:38 94 mydir.bat
1 File(s) 94 bytes
2 Dir(s) 12,981,030,912 bytes free
C:\test1>copy con fred
A wee test file to investigate file timestamp behaviour.
I will wait until the minute rolls over to see if the
created and modified stamps differ.
^Z
1 file(s) copied.
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>
Wait for a few minutes.
C:\test1>type fred
A wee test file to investigate file timestamp behaviour.
I will wait until the minute rolls over to see if the
created and modified stamps differ.
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>
Lets try Notepad instead:-
C:\test1>notepad fred
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>
C:\test1>notepad fred
## Save file from Notepad ##
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:52 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:52 153 fred
The same times are shown in Explorer.
I am puzzled by the meaning/use of the field last accessed date in NTFS.
I wish to use it for data archiving but can't find out when the field is altered.
Opening the file does NOT seem to change the "accessed" time stamp.
What is it for? From the observed behaviour accessed seems to mean the
same as modified? This makes no sense - to me.
I have done a bit of searcing but can find nothing useful.
C:\test1>dir
Volume in drive C has no label.
Volume Serial Number is 0513-E435
Directory of C:\test1
10/11/2004 12:40 <DIR> .
10/11/2004 12:40 <DIR> ..
10/11/2004 12:38 94 mydir.bat
1 File(s) 94 bytes
2 Dir(s) 12,981,030,912 bytes free
C:\test1>copy con fred
A wee test file to investigate file timestamp behaviour.
I will wait until the minute rolls over to see if the
created and modified stamps differ.
^Z
1 file(s) copied.
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>
Wait for a few minutes.
C:\test1>type fred
A wee test file to investigate file timestamp behaviour.
I will wait until the minute rolls over to see if the
created and modified stamps differ.
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>
Lets try Notepad instead:-
C:\test1>notepad fred
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:42 153 fred
C:\test1>
C:\test1>notepad fred
## Save file from Notepad ##
C:\test1>mydir
C:\test1>dir /t:a fred | grep -i fred
10/11/2004 12:52 153 fred
C:\test1>dir /t:c fred | grep -i fred
10/11/2004 12:41 153 fred
C:\test1>dir /t:w fred | grep -i fred
10/11/2004 12:52 153 fred
The same times are shown in Explorer.