I have a Vista Home image and have several folders with the pattern of the last accessed date being different than the creation date. The NtfsDisableLastAccessUpdate key is set to 1 which is the default. If Vista is populating the last accessed date with the creation date information, which is my understanding that it does, how can the folder last accessed and creation dates be different?
Does it make any difference if the folder is created as a new folder, or moved from another location / drive?
Whend files are moved, the creation date can be newer than the modified date. Are you seeing something similar?
This is the part I'm not understanding - the folders are in c\user\Appdata\local\virtual store\Program Files\Downloads 1 and the folders are subfolders of Downloads 1. Microsoft talks about if you copy a file from DNTFS to D\NTFS\Sub, it keeps the same modified date and time and but changes the created date and time. If you move a folder from D\NTFS to D\NTFS\Sub, it keeps the same modified date and time and keeps the created date and time. The part I'm not understanding/missing is that if Vista uses the created time to populate the last accessed date, it shouldn't make any difference whether the folder is newly created, copied or moved - the last access date should always reflect whatever is listed as the creation date. If the creation date gets changed as a result of a copy, then the last access date should change also because it's getting the date from the creation date. In the cases I'm referring to, I have a last accessed date of 02-05-09, a creation date of 10-30-07, a last written date of 02-05-09 and an entry modified date of 02-06-09. If the last accessed/creation dates matched, all would be well.
RGass
Off the top of my head I would suggest this as a hypothesis, -
A folder's modified date gets updated when a file or folder within the folder is modified.
When a folder's modified date gets updated the accessed date also gets updated to the same value. (I haven't checked but would guess not exactly the same value but to a resolution of a second or two)
When a file is modified the modified and accessed date are often updated to the same value. This is variable i.e. when some files are updated the modified and accessed gets updated and others just the modified date. I haven't identified what the criteria is that causes this difference, in tests I have done on this previously it appears to vary depending upon file type and/or the application used to modify the file.
When a folder is first created the created, modified and accessed dates will generally be the same. (I qualify that with generally as a folder extracted from an archive can sometimes retain the original dates).
As I said this is off the top of my head so would need testing to confirm.
H
Could it be something as simple as someone changed the NtfsDisableLastAccessUpdate key to 0 at some point, which would allow the Last Accessed Date to be updated, then changed it back to 1? If there are restore points or shadow volumes around early February, I would check those to see if the registry key was set to 0 or 1.