-2

I always turn last access timestamps off, for performance, and frankly for privacy. But Windows and Linux both seem to have them as a feature enabled by default, so I suppose there must be some use for them.

For what specific purpose were access timestamps invented, and then considered useful enough to warrant inclusion in operating system kernels and filesystems? Are they still useful today, or just historical cruft?

"Primarily opinion-based", yeah right. Where did I ask for anyone's opinion? I'm interested in real-world examples of applications where they are used, or historical justifications/discussions from when they were added in the first place, or lack thereof if indeed they are useless. I guess for some people, looking for reasons to close questions feels like an accomplishment, without involving any real effort.

Improve this question
2

They can be useful in specific situations (informal audit, archiving) but it is common practice on Linux at to disable (noatime), or at least minimize (relatime), the use of it in most situations due to performance and/or privacy concerns. Often mtime (modification time) and ctime (change time) are the more useful timestamps to use.

In addition to the performance overhead, something that often renders atime less useful is that both your operating system and commonly used tools (backup utilities etc.) end up 'touching' many files that are otherwise unused by users. So unless they support avoiding updating atime[1], using it for audit trails or archiving can be rendered useless if common automated tasks result in the atime being updated.

[1] In many audit situations, the ability to avoid updating atime would be a red flag to auditors since the very fact that it could be bypassed would render it invalid in their eyes. i.e. a malicious actor could use those same facilities to avoid detection.

Improve this answer
  • Audit? Does that mean like.. intrusion detection? – Boann Oct 11 '18 at 14:26
  • @Boann yes, that would be the main way to try to use it that I can think of (but it's a very weak use case since you won't know who accessed the file, only that it was accessed) – blihp Oct 11 '18 at 16:02
  • So it's not very useful then. – Boann Oct 11 '18 at 18:15
  • 1
    Not terribly, which is why it's common practice to disable it – blihp Oct 11 '18 at 18:16
1

Many computers are used in business environments, not the home. Most businesses have both legal and practical requirements to ensure that data is auditable.

They are also useful in managing the filesystem, cacheing, and backup processes.

Heck, they are useful when you wrote 3 documents with similar names, and you don’t remember which was the last one you worked on.

Improve this answer
  • "They are also useful in managing the filesystem, caching, and backup processes." But useful how? – Boann Oct 11 '18 at 14:27
  • Many filesystems will optimize the physical organization of a disk based on frequency that a particular piece of data is accessed. Cache uses the data similarly. If you take a moment to think about how these systems work, it’s easy to understand why timekeeping is essential. There is no privacy gained by turning them off, if someone wants to keep track of what files you’ve been looking at, there are a multitude of alternative forensic methods. – Don Simon Oct 11 '18 at 15:55
  • I've never heard of these "many filesystems" or caches doing this. – Boann Oct 12 '18 at 15:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.