Disable Last Access Time Stamps (Standard 7 SP1)


If you are using an NTFS file system, you can increase the performance of EWF by disabling the last access date/time stamps.

To disable Last Access timestamps

  • Create the following registry key on your run-time image:

    Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

    Name: NtfsDisableLastAccessUpdate

    Type: REG_DWORD

    Value: 1



If you need to re-enable Last Access Time Stamps, change the value of the NtfsDisableLastAccessUpdate key to 0, or delete the NtfsDisableLastAccessUpdate key. For more information, see NtfsDisableLastAccessUpdate.

See Also

Other Resources

EWF Performance Considerations
EWF Design Considerations