Member Avatar for JoeRas

Hello, Is there any way to change or erase the date last accessed info on a file?

Thanks, Joe

  • 5 Contributors
  • 5 Replies
  • 285 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by Lurch

Dani AI

Generated

Quick answer: you can change or remove a file's Last Accessed time without "editing the NTFS DB" or fiddling with the system clock. Windows exposes APIs and simple tools that let you set the creation/last‑write/last‑access timestamps directly; NTFS just stores those values and they can be changed programmatically. (learn.microsoft.com)

If you want a quick built‑in method use PowerShell. Example (run as an account that can write the file attributes):

# set LastAccessTime to a specific date/time
(Get-Item "C:\path\to\file.txt").LastAccessTime = Get-Date "2003-12-01 08:00"

# or set it to now (touch equivalent)
(Get-Item "C:\path\to\file.txt").LastAccessTime = (Get-Date)

Under the hood this calls the same file APIs. It requires permission to write file attributes. (learn.microsoft.com)

Before changing timestamps, check the system policy: Windows can defer or even disable Last Access updates (to improve performance), so setting the stamp may not behave how you expect unless LastAccess updates are enabled. Check and change the setting with fsutil (requires admin and a reboot when you change it):

fsutil behavior query disablelastaccess
fsutil behavior set disablelastaccess 0   # enable updates (0) or 1 to disable

If LastAccess updates are disabled on your machine, you can still forcibly set the stored timestamp (PowerShell/tools will still write it), but normal reads may not update it later. (learn.microsoft.com)

If you prefer a GUI or bulk changes, use a trusted utility such as NirSoft BulkFileChanger or small "touch" ports for Windows (Git Bash/WSL, UnxUtils, Funduc FS Touch, etc.). These tools call the same APIs and are convenient for batches. As suggested, you do not need to edit raw NTFS structures; and as noted, changing the system clock is fragile and not recommended. Use PowerShell or a dedicated tool instead. (nirsoft.net)

Cautions: changing timestamps can affect backups, indexing, and forensic timelines. Always work on copies if preserving original evidence or metadata is important. (learn.microsoft.com)

Recommended Answers

All 5 Replies

Member Avatar for Zachery

not really, youd probally hafta edit the NTFS DB which im not even sure if its possible

Member Avatar for alc6379

You could set the date/time back on the machine, and then access the file, thus giving it an earlier file date...

That's kind of a ghetto solution, but it may work.

Member Avatar for TallCool1

Hello, Is there any way to change or erase the date last accessed info on a file?

Look for a "touch" command that will work on NTFS. I know it exists.

Member Avatar for alc6379

Look for a "touch" command that will work on NTFS. I know it exists.

But, the important thing is, which way is he wanting to change it? Is he trying to make it look like the file hadn't been accessed later than a specific date, or does he just want to make the date different from what it is?

Member Avatar for Lurch

How's about something like "Attribute Changer" http://www.petges.com/

Might do it for ya.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.