0

Revised: What is the behaviour of the NTFS installable filesystem driver when renaming files on Windows NT 5.1?

Will the driver update last access time for any operation on the MFT entry for a file or only for specific attributes within the MFT entry (ie data, security descriptor, or file name).

Old: Does fsutil update last access time on NTFS when a file is renamed or moved using the command line?

Does fsutil update last access time on NTFS for any operation that does not touch the data attribute in the MFT?

1
  • The answer is, strictly speaking, two words: "No." and "No.". That's because you're asking about the wrong thing. fsutil isn't involved in the processes of renaming or otherwise operating on individual files. You should be asking "What is the behaviour of the NTFS installable filesystem driver when renaming files?". For best results, you need to be specific about which version of Windows NT you'd like to know about, too.
    – JdeBP
    Jan 10, 2012 at 15:15

1 Answer 1

0

Remarks

  • The behavior subcommand writes changes to the registry, so you must restart the computer for changes to take effect.

  • Using disable8dot3 {1|0}

    When disable8dot3 is set to 0, every time you create a file with a long file name, NTFS creates a second file entry that has an 8.3 character-length file name. When NTFS creates files in a folder, it must look up the 8.3 character-length file names associated with the long file names.

    This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation registry key.

  • Using allowextchar {1|0}

    This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsAllowExtendedCharacterIn8dot3Name registry key.

  • Using disablelastaccess {1|0}

    The disablelastaccess parameter is designed to reduce the logging impact of updating the last access timestamp on folders and directories. Disabling the Last Access Time improves the speed of folder and file access.

    Last Access Time details:

    Each file and folder on an NTFS volume contains an attribute called Last Access Time. This attribute defines when the file or folder was last accessed, such as when a user lists folders, adds files to a folder, reads a file, or makes changes to a file. The most up-to-date Last Access Time is stored in memory and is eventually written to the disk in two different locations. One is within the file's attribute, which is part of its MFT record. The second is in the index of the directory that contains the file.

    The Last Access Time on disk is not always current. This lag occurs because NTFS delays writing the Last Access Time to disk when users or programs perform read-only operations on a file or folder, such as listing the folder's contents or reading (but not changing) a file in the folder. If the Last Access Time is kept current on disk for read operations, all read operations become write operations, which impacts NTFS performance.

    Note that file-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

    NTFS typically updates a file's attribute on disk if the current Last Access Time in memory differs by more than an hour from the Last Access Time stored on disk, or when all in-memory references to that file are gone, whichever is more recent.

    For example, if a file's current Last Access Time is 1:00 P.M., and you read the file at 1:30 P.M., NTFS does not update the Last Access Time. If you read the file again at 2:00 P.M., NTFS updates the Last Access Time in the file's attribute to reflect 2:00 P.M. because the file's attribute shows 1:00 P.M. and the in-memory Last Access Time shows 2:00 P.M.

    NTFS updates the index of the directory that contains the file when NTFS updates the file's Last Access Time and detects that the Last Access Time for the file differs by more than an hour from the Last Access Time stored in the directory's index. This update typically occurs after a program closes the handle used to access a file within the directory. If the user holds the handle open for an extended time, a lag occurs before the change appears in the index entry of the directory.

    Note that one hour is the maximum time that NTFS defers updating the Last Access Time on disk. If NTFS updates other file attributes such as Last Modify Time, and a Last Access Time update is pending, NTFS updates the Last Access Time along with the other updates without additional performance impact.

    Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature.

    This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate registry key.

  • Using mftzone value

    The value is an approximation of the initial size of the MFT plus the MFT Zone on a new volume and is set at mount time for each file system. As space on the volume is used, NTFS adjusts the space reserved for future MFT growth. If the MFT Zone is already large, the full MFT Zone size is not reserved again. Since the MFT Zone is based on the contiguous range past the end of the MFT, it shrinks as the space is used.

    The file system does not redetermine the MFT Zone location until the current MFT Zone is completely used. This never occurs on a typical system.

Source: Microsoft Doc

2
  • May this HELP you ? technet.microsoft.com/en-us/library/cc781134%28WS.10%29.aspx
    – bZezzz
    Jan 10, 2012 at 17:02
  • Thank you. I am looking for more detail on what "This attribute defines when the file or folder was last accessed, such as when a user lists folders, adds files to a folder, reads a file, or makes changes to a file. " means exactly. Specifically, what does "reads a file" actually mean? Does it refer to any attribute in the MFT or just the data of a file entry?
    – George
    Jan 10, 2012 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .