windowswinapifilesystemsnfsntfs

Which operations update last access time?


Assuming given filesystem is tracking Last Access Time (aka atime) -- which operations on a file cause atime to update?

As far as I know:

Is there an exhaustive list of operations that update atime?


Solution

  • The last access time includes the last time the file or directory was written to, read from, or, in the case of executable files, run.

    Other operations, like accessing the file to retrieve properties to show in Explorer or some other viewer, accessing the file to retrieve its icon etc. don't update last access time.

    Refer to "GetFileTime - lpLastAccessTime", "How do I access a file without updating its last-access time?"

    Update: Add test results of read/write 0 bytes and read/write 1 bytes.

    Code used for testing:

    void GetLastAccessTime(HANDLE hFile)
    {
        FILETIME ftAccess;
        SYSTEMTIME stUTC, stLocal;
    
        printf("Get last access time\n");
    
        // Retrieve the file times for the file.
        if (!GetFileTime(hFile, NULL, &ftAccess, NULL))
            return;
    
        // Convert the last-write time to local time.
        FileTimeToSystemTime(&ftAccess, &stUTC);
        SystemTimeToTzSpecificLocalTime(NULL, &stUTC, &stLocal);
    
        // Build a string showing the date and time.
        wprintf(
            L"%02d/%02d/%d  %02d:%02d \n",
            stLocal.wMonth, stLocal.wDay, stLocal.wYear,
            stLocal.wHour, stLocal.wMinute);
    }
    
    int main()
    {
        HANDLE tFile = INVALID_HANDLE_VALUE;
    
        printf("Open file\n");
        // Open file
        tFile = CreateFile(L"C:\\Users\\ritah\\Desktop\\test1.txt", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
        if (INVALID_HANDLE_VALUE == tFile)
        {
            printf("CreateFile fails with error: %d\n", GetLastError());
            getchar();
            return 0;
        }
    
        printf("Sleep 60 seconds\n");
        Sleep(60000);
    
        GetLastAccessTime(tFile);
    
        // Read 0 bytes
        printf("Read 0 bytes\n");
        WCHAR redBuf[10];
        DWORD redBytes = 0;
        if(!ReadFile(tFile, redBuf, 0, &redBytes, NULL))
        {
            printf("ReadFile fails with error: %d\n", GetLastError());
            getchar();
            return 0;
        }
    
        printf("Sleep 60 seconds\n");
        Sleep(60000);
    
        GetLastAccessTime(tFile);
    
        // Write 0 bytes
        printf("Write 0 bytes\n");
        WCHAR writeBuf[] = L"write test";
        DWORD writeBytes = 0;
        if(!WriteFile(tFile, writeBuf, 0, &writeBytes, NULL))
        {
            printf("WriteFile fails with error: %d\n", GetLastError());
            getchar();
            return 0;
        }
    
        printf("Sleep 60 seconds\n");
        Sleep(60000);
    
        GetLastAccessTime(tFile);
    
        getchar();
    }
    

    enter image description here

    enter image description here

    So, read/write 0 bytes doesn't update last access time.