When was a file last accessed in Windows 7

Question

Is it possible to see when a text file is opened on Windows 7?

I looked in the with Event Viewer a little bit but I couldn't find where to see the logs about a specific text file being accessed.

Answer 1

When was a file last accessed in Windows

You should note the below and if you have this enabled then you can find the file properties attribute of Last Accessed:

For improved file system performance, Last Access time update is switched off since Windows Vista by default (also, Windows 2008 / 2008 R2, Windows 7). Thus, Last Access time attribute is set upon creating file and not changed afterwards even if file is modified. However, it is possible to enable Last Access time updates if necessary.

To enable updates, open Registry Editor by typing regedit in Search input on Start Menu, locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem path entry and change NtfsDisableLastAccessUpdate value data to 0. After this change, the system has to be restarted. Alternatively, run the following command with administrator rights:

fsutil behavior set disablelastaccess 0

_source

Right-click on the file and select Properties

From the General tab you will see the Last Accessed attributes

Answer 2

You can right click on the text file and click on Properties, from there, it will tell you when it was last accessed.

Answer 3

If you do enable that filesystem option (by default it isn't, as discussed in previous answers), then this command will show the last accessed time:

wmic DataFile where "Name='C:\\Users\\Default\\NTUSER.DAT'"