Folder Access

[Grommit]

Hi

 

Without setting up a GPO to Audit a folder.

 

Is there some program that can tell me when a folder in the shared folder was accessed.. not modified.... but just opened ?

 

As there are tons of folders in the share and i want to start pruning :-)

 

Many Thanks

[Geoff]

NTFS does not record access times.

[Grommit]

NTFS does not record access times.

 

It does if you put an audit on... but if i did that my logs would be full in hours...

 

 

What i need is something like Treesize pro that can tell me the size as well as the last access of the folder....

[Grommit]

any ideas?

[mac_shinobi]

maybe the FSO ( File System Object )

 

http://www.tutorial-web.com/asp/fso/folder.asp?property=DateLastAccessed

[Grommit]

maybe the FSO ( File System Object )

 

http://www.tutorial-web.com/asp/fso/folder.asp?property=DateLastAccessed

 

Many thank... but I think this will give me when the folder was accessed by a seacrh or any other process...

 

"Determines the date the folder was last accessed by a process"

 

I am looking for a user access program

[mac_shinobi]

Is this shared folder located on the server i take it ?

 

Would you mind having a script that ran every so often on the server if it is located on the server ?

 

Aside from that then it would be a case of enabling auditing that or using a program like everest or siw.

[Ric_]

NTFS does not record access times.

 

It does if you put an audit on... but if i did that my logs would be full in hours...

 

The audit isn't a feature of NTFS. If NTFS did record the access times you could interrogate the filesystem... I believe that this is what Geoff is getting at.

[mac_shinobi]

NTFS does not record access times.

 

It does if you put an audit on... but if i did that my logs would be full in hours...

 

 

What i need is something like Treesize pro that can tell me the size as well as the last access of the folder....

 

So tell me this, how does tree size pro manage to do it then ?

 

Also just a thought but cant you do an audit and use wmi to filter out the results so that it only audits what you want it to and hence not fill up the audits as fast as it normally would... ??

[ITWombat]

NTFS does not record access times.

 

Are you sure about that? It may not record the user who last accesed the file but it does record last access times. You can view in explorer by adding an extra couln to the details view. Alternatively, from the command line you can also do this

DIR /TA

 

Only problem is that some back-up software may reset access times while reading files to be backed up.

[Ric_]

I was under the same impression as Geoff, only creation and modification times are recorded.

 

I may (and probably am) wrong. Maybe one of ChrisH's magical books would help

[ITWombat]

Occassionally you see adivce in books or artices that you can increase file system performance by stopping acces time being recorded. Maybe this is what was done on systems you have you have come into contact with.

[PiqueABoo]

There are four timestamps associated with a file: The ones you can see in Explorer [created, modified, accessed] & one associated with the MFT entry that the forensics folk probably don't want you know about.

 

If you have processes automatically reading files (anti-virus scans?), none of those are much use as a "no one has used it for ages" detector.

 

YMMV, but disabling the recording of NTFS last access times certainly can help file system performace - useful if the system spends a lot of time reading lots of folders and little files.