Note:I translated Japanese into English using Google Translate.
Thank you, Google.
I confirmed DisableLastAccess in verification environment. The size of C: is 40 GB.
The value of DisableLastAccess was "2" and "Disabled"...."Disabled"???
I confirmed the settable value with disablelastaccess.
I saw Forensic Lunch Test Kitchen 12/6/18 and understood the meaning of "Disabled"!
Thank you!
Check the timestamp of Accessed in the property of the sample image file.
Again, display the properties. (File is not opened)
Accessed has been updated.
Connect the USB memory(58.5GB) and repeat the same procedure.
Again, display the properties. (File is not opened)
Accessed has been updated.
I added a 150 GB volume to the test environment.
Check the time stamp of the sample image file.
>fsutil file layout Dragonfly.jpg
Last Access Time : 12/9/2018 10:09:20 (UTC)
Display the properties. (File is not opened)
Again, Check the time stamp of the sample image file.
Last Access Time has been updated.
Muuu??
Time stamp resolution is not 1 hour?
I need to continue testing.
Verification environment: Windows 10 1083
Reference URL:
File Times - Windows applications | Microsoft Docs
