Is it possible to see when a text file is opened on Windows 7?

I looked in the with Event Viewer a little bit but I couldn't find where to see the logs about a specific text file being accessed.


When was a file last accessed in Windows

You should note the below and if you have this enabled then you can find the file properties attribute of Last Accessed:

For improved file system performance, Last Access time update is switched off since Windows Vista by default (also, Windows 2008 / 2008 R2, Windows 7). Thus, Last Access time attribute is set upon creating file and not changed afterwards even if file is modified. However, it is possible to enable Last Access time updates if necessary.

To enable updates, open Registry Editor by typing regedit in Search input on Start Menu, locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem path entry and change NtfsDisableLastAccessUpdate value data to 0. After this change, the system has to be restarted. Alternatively, run the following command with administrator rights:

enter image description here

fsutil behavior set disablelastaccess 0


Right-click on the file and select Properties

enter image description here

From the General tab you will see the Last Accessed attributes

enter image description here

  • 5
    You have good chances to accidentally access the file while before opening the properties dialog. (e.g. by windows explorer creating a thumbnail or reading embedded metadata) – CodesInChaos Aug 4 '16 at 14:07
  • Or perhaps by right-clicking the file and clicking Properties?? – I say Reinstate Monica May 4 '17 at 3:47
  • @Spittin'IT LOL, no, I was wondering if by accessing the file's Properties dialog one might ironically trigger an update of the Last Accessed timestamp. – I say Reinstate Monica May 4 '17 at 12:45
  • @Twisty I might try to test this on a Win 7 machine at some point toggling the reg key to see what results I get either way--good thought!! If you wanted to be real slick, I suppose you could look into the NTFS MFT records or USN Journals regardless of what the OS does, so I wonder what would show at this level, but I won't get that sophisticated with it. – Pillsbury IT Doughboy May 4 '17 at 13:23

You can right click on the text file and click on Properties, from there, it will tell you when it was last accessed.


If you do enable that filesystem option (by default it isn't, as discussed in previous answers), then this command will show the last accessed time:

wmic DataFile where "Name='C:\\Users\\Default\\NTUSER.DAT'"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.