Disable Last Access Time Stamps (Standard 7 SP1)
7/8/2014
If you are using an NTFS file system, you can increase the performance of EWF by disabling the last access date/time stamps.
To disable Last Access timestamps
Create the following registry key on your run-time image:
Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Name: NtfsDisableLastAccessUpdate
Type: REG_DWORD
Value: 1
Notes
Note
If you need to re-enable Last Access Time Stamps, change the value of the NtfsDisableLastAccessUpdate key to 0, or delete the NtfsDisableLastAccessUpdate key. For more information, see NtfsDisableLastAccessUpdate.