Disable Last Access Time Stamps (Standard 7 SP1)


If you are using an NTFS file system, you can increase the performance of EWF by disabling the last access date/time stamps.

  • Create the following registry key on your run-time image:

    Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

    Name: NtfsDisableLastAccessUpdate

    Type: REG_DWORD

    Value: 1

If you need to re-enable Last Access Time Stamps, change the value of the NtfsDisableLastAccessUpdate key to 0, or delete the NtfsDisableLastAccessUpdate key. For more information, see NtfsDisableLastAccessUpdate.