Hello.
recently, I found that last accessed times of files in my virtualbox that windows xp sp2 installed are updated automatically when I just select the files!
…..the last part omitted
sorry.
I'm so confusing at this problem. I think I have to gether more informtion and clues to help me and you ()) It is better than I just ask you guys messy question. haha.
UPDATE
OK. There are obviously something curious, at least, for me.
Case 1
os windows xp pro sp2 on virtualbox
details on explorer Date Accessed (only one, no other time stamp, no size)
system's current time 1/26/2010 0910 PM (in KST)
step 1 go to C\Program Files\Movie Maker
step 2 set all file's accessed time/date to 1/1/2010 10000 (I'm using NewFileTime 1.23)
step 3 wait for 5 seconds (with no action, just watching)
step 4 refresh files (hit F5)
my result all file's accessed times are changed to current time (1/26/2010, … in KST)
what are your results?
Case 2
os windows 7 ultimate x64
details on explorer C, M, A Time/date, type, size
step 1 go to C\Program Files (x86)\Windows Media Player
step 2 checksetup_wml's Accessed date, It was 1/26/2010 619 PM
step 3 select that filea and make it highlighted. (and no more action. just click once)
step 4 refresh file (hit F5)
My result setup_wm.exe's Accessed date is changed to current time.
what are your results?
addition
when I selected other DLL file in the same folder, they were not changed. It seems like it happens to some epecific file type (exe, avi, msi) but dll, jpg, dat file type are not affected.
another question. P
os windows xp/7
File's accessed time/date is updated when process closes file handle. Untill now, I've thought if notepad open some text file it will not update opened file's accessed time/date untill notepad is closed (It means opened file's handle is closed I think) But according to my test, when notepad opens files, that file's accessed time/date is changed immediately befor notepad is closed or save files. is this normal situation?
thanks )
if you refreshed the file didn't you technically access it because surely windows would have to access the file to refresh it?
I think all things we can see on the windows explorer are from directory enties(directory file MFT enties that have $INDEX_ROOT or/and $INDEX_ALLOCATION attribute) in MFT entries. So if refresh the files it will look up directory entries, not file's cluster. As I know file's last accessed time is updated only when file is opened by some API like createFile().
So answer is 'no' I didn;t. but Windows did I think.
It's not clear what you're doing, but it may depend on your Explorer settings. For example, if you have the settings such that more than just file system metadata (last access date, size) are displayed, then the file will, in fact, be accessed in order to display the information.
Explorer accesses meta-data in files even if you just hover the mouse over the file … up pops a box with info in it and the access date/time gets tripped.
The metadata displayed (extension, last mod time, size) is all file system metadata that, when accessed, do NOT modify the last access time.
When you hover over a Word doc or a PDF in XP, the title and author are shown in the pop-up - at least on my machine … this doesn't come from the file system.