8

Is it possible to see when a text file is opened on Windows 7?

I looked in the with Event Viewer a little bit but I couldn't find where to see the logs about a specific text file being accessed.

Improve this question
0

3 Answers 3

Reset to default
19

When was a file last accessed in Windows

You should note the below and if you have this enabled then you can find the file properties attribute of Last Accessed:

For improved file system performance, Last Access time update is switched off since Windows Vista by default (also, Windows 2008 / 2008 R2, Windows 7). Thus, Last Access time attribute is set upon creating file and not changed afterwards even if file is modified. However, it is possible to enable Last Access time updates if necessary.

To enable updates, open Registry Editor by typing regedit in Search input on Start Menu, locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem path entry and change NtfsDisableLastAccessUpdate value data to 0. After this change, the system has to be restarted. Alternatively, run the following command with administrator rights:

enter image description here

fsutil behavior set disablelastaccess 0

source

Right-click on the file and select Properties

enter image description here

From the General tab you will see the Last Accessed attributes

enter image description here

Improve this answer
4
  • 5
    You have good chances to accidentally access the file while before opening the properties dialog. (e.g. by windows explorer creating a thumbnail or reading embedded metadata)
    – CodesInChaos
    Aug 4, 2016 at 14:07
  • Or perhaps by right-clicking the file and clicking Properties??
    – I say Reinstate Monica
    May 4, 2017 at 3:47
  • @Spittin'IT LOL, no, I was wondering if by accessing the file's Properties dialog one might ironically trigger an update of the Last Accessed timestamp.
    – I say Reinstate Monica
    May 4, 2017 at 12:45
  • @Twisty I might try to test this on a Win 7 machine at some point toggling the reg key to see what results I get either way--good thought!! If you wanted to be real slick, I suppose you could look into the NTFS MFT records or USN Journals regardless of what the OS does, so I wonder what would show at this level, but I won't get that sophisticated with it.
    – Vomit IT - Chunky Mess Style
    May 4, 2017 at 13:23
4

You can right click on the text file and click on Properties, from there, it will tell you when it was last accessed.

Improve this answer
1
0

If you do enable that filesystem option (by default it isn't, as discussed in previous answers), then this command will show the last accessed time:

wmic DataFile where "Name='C:\\Users\\Default\\NTUSER.DAT'"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .