Last Access Preservation

[Poutnik]

Hello,

The Last access time stamp preservation was questioned in spring 2008 and September 2009 with confirmation Last Access is not preserved by on demand full disk scan.

According to MBAM Changelog on Softpedia

MBAM still does not preserve it, at least a fix was not mentioned there.

It keeps me away from using MBAM as full disk scanner, as far as LA TSt functionality is important for my disk optimization scripts in MyDefrag

MBAM with SAS are said to be on the TOP of AntiSpyware SW.

Do not you think SW at such position should have also top quality of data handling ?

I know many software ( including standard Windows Defender (fixed version on demand only ) or Explorer file properties tab ) does not preserve it.

But many do, as e.g. Avast! AV full scan, or filemanagers like FreeCommander or 7-zip filemanager.

Fighting against sophisticated malware is IMHO much more difficult than treating file time stamps by way, what is expected from scanning software.

It could bring the question if MBAM fails at a simple thing I can easily check ( LA TSt ), should I trust MBAM at difficult things ( malware) that I cannot check ?

[noknojon]

Hi -

Are you running the free or paid version of Malwarebytes -

I use Defraggler as a backup to M/soft Defrag -

Thank You -

[Poutnik]

Hi -

Are you running the free or paid version of Malwarebytes -

I use Defraggler as a backup to M/soft Defrag -

Thank You -

I use free version - I would otherwise include my licence or so.

I have intended it more like suggestion than a support request.

I guess Defraggler is not for me an option,

as far as Mydefrag is superior to most SW of this kind.

[noknojon]

-

It always is a (free) option to all - I used several after a corrupted file in M/soft Defrag slowed it down -

EDIT - I have all the logs dated back since I reinstalled so I do not know your problem -

[Poutnik]

-

It always is a (free) option to all - I used several after a corrupted file in M/soft Defrag slowed it down -

EDIT - I have all the logs dated back since I reinstalled so I do not know your problem -

I am little confused by your replies, as far as none of them is addressing Last Access Time stamp question,

neither it comment current MBAM status.

[noknojon]

Last Access Time stamp

I hope you are asking about the Time stamps in the MBAM logs - Is this the question or not ??If not I cannot understand your question -

There will not be a Last Access Time Stamp except for your logs -

The updates have no Time Stamp or just Looking has no Time Stamp -

If you access the log history of your scans (Quick or Full) they will all have the Date and a Time listed as these ones from my logs below have -

8/05/2010 06:35:34 PM

mbam-log-2010-05-08 (18-35-34).txt

On the Face Page of the program you just click on Logs -

This will also list the times you started a scan even if you Aborted it -

Thank You -

[Poutnik]

Last Access Time stamp

I hope you are asking about the Time stamps in the MBAM logs - Is this the question or not ??If not I cannot understand your question -

There will not be a Last Access Time Stamp except for your logs -

The updates have no Time Stamp or just Looking has no Time Stamp -

If you access the log history of your scans (Quick or Full) they will all have the Date and a Time listed as these ones from my logs below have -

8/05/2010 06:35:34 PM

mbam-log-2010-05-08 (18-35-34).txt

On the Face Page of the program you just click on Logs -

This will also list the times you started a scan even if you Aborted it -

Thank You -

Thank you for your effort in replying, nokjonon.

I have not in mind MBAM logs at all, neither I have ever mentioned them.

I mean Last Access file stamps as NTFS file attribute, similar as are File creation and Last modified.

I have hoped it was clear from description, if not I apologize.

[YoKenny1]

I disable Last access time stamp on my XP Pro system as I find it slows it down too much

Whenever XP reads a file, it stamps the file with the date and time of the access.

This feature has its place but is not required for normal use unless you rely on the date of last access for backup purposes, which is a rare requirement for most backups. Putting a timestamp on a file that has just been read means that a write access has to be made to disk, so every time a read is executed, a corresponding write is also executed.

http://www.tech-recipes.com/rx/1531/how_to_disable_last_access_timestamp_to_speed_up_xp

This is disabled by default in Windows Vista and Windows 7 by default.

[Poutnik]

I disable Last access time stamp on my XP Pro system as I find it slows it down too much http://www.tech-recipes.com/rx/1531/how_to_disable_last_access_timestamp_to_speed_up_xp

This is disabled by default in Windows Vista and Windows 7 by default.

As far as Last access is kept in memory and disk records are updated if difference is 30-60 minutes, it cannot be significant slow down.

Having it activated, I see 70-75 % of all files in my vista system partition is not accessed during last month,

keeping them away on slower disk tracks in not accessed file zone.

therefore in my case LA is speeding up the system, keeping accessed files on fast tracks

and keeping low access times to these file, being in compact area.

[Poutnik]

The most up-to-date Last Access Time is stored in memory and is eventually written to the disk in two different locations. One is within the file's attribute, which is part of its MFT record. The second is in the index of the directory that contains the file.

The Last Access Time on disk is not always current. This lag occurs because NTFS delays writing the Last Access Time to disk when users or programs perform read-only operations on a file or folder, such as listing the folder's contents or reading (but not changing) a file in the folder. If the Last Access Time is kept current on disk for read operations, all read operations become write operations, which impacts NTFS performance.

Note that file-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

NTFS typically updates a file's attribute on disk if the current Last Access Time in memory differs by more than an hour from the Last Access Time stored on disk, or when all in-memory references to that file are gone, whichever is more recent. For example, if a file's current Last Access Time is 1:00 P.M., and you read the file at 1:30 P.M., NTFS does not update the Last Access Time. If you read the file again at 2:00 P.M., NTFS updates the Last Access Time in the file's attribute to reflect 2:00 P.M. because the file's attribute shows 1:00 P.M. and the in-memory Last Access Time shows 2:00 P.M.

http://www.microsoft.com/resources/documen...r.mspx?mfr=true

[Poutnik]

All seems to be a result of tons of pages, describing how to turn it off, not correctly describing why.....

MS gave to people in Vista W7, what they wanted.

[noknojon]

Note that file-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

This is only a forum area that deals with Malwarebytes' Anti-Malware Support - If you have any problems with M/soft , then they have their own forums -

Please visit them and see if they have answers relating to the Time Stamp problems -

Thanks for your interest -

[Poutnik]

This is only a forum area that deals with Malwarebytes' Anti-Malware Support - If you have any problems with M/soft , then they have their own forums -

Please visit them and see if they have answers relating to the Time Stamp problems -

Thanks for your interest -

Noknojon,

I am not sure if you have got the point.

Avast, FreeCommander, 7-zip, Mydefrag and others knows what Last Access time stamps are and how to treat them.

It is MBAM that has problems with proper treatment of Last Access of files.

IF MBAM forum creates a picture

they do not know what it is,

that I should not use it,

that I should ask elsewhere how to solve MBAM issues

What should I think about MBAM team?

It does not create good image of MBAM at all.

[noknojon]

This feature has its place but is not required for normal use unless you rely on the date of last access for backup purposes, which is a rare requirement for most backups. Putting a timestamp on a file that has just been read means that a write access has to be made to disk, so every time a read is executed, a corresponding write is also executed.

At the command prompt, enter the following then reboot:

FSUTIL behavior set disablelastaccess 1

To turn timestamps back on, repeat the command but replace the 1 with 0.

May not be what you want but that is the solution for you to check -

Most people seem to want it OFF -

There is not a good reason for this function - Even though you should only list it in Suggestions Here as it is not a Malware problem for here -

[Poutnik]

This feature has its place but is not required for normal use unless you rely on the date of last access for backup purposes, which is a rare requirement for most backups. Putting a timestamp on a file that has just been read means that a write access has to be made to disk, so every time a read is executed, a corresponding write is also executed.

There is no use for repeat of these statements - they are not true in both of use and how LA works. I know very well how to turn LA ON or OFF and I am not going to change it.

The problem is not I have set it ON. It is on purpose. The problem is MBAM is not able to manage it, if it is set ON.

The whole communication in this thread is rather strange, I have encountered similar approach on SW support forums very selfdom in lets say last 14 years. Even feedback from newsgroups shows similar feelings.

Most people seem to want it OFF - There is not a good reason for this function - Even though you should only list it in Suggestions Here as it is not a Malware problem for here -

Most people on MyDefreg forums also want to sort all movie files according a name and there no good reason for it either.

Without a good reason AVG and Avast would hardly bother to make it working when notified. Why not to confess MBAM does not know how to deal with it ?

I apologize for bad placement, but structure of MBAM forums is misleading. Mentioned forum is out of explicit context of MBAM, and description

"Here you can add your comments and suggestions to improve this site and/or posts your thanks. All comments are welcome."

does not appear to be the right forum for MBAM SW suggestions.

If to choose LA or MBAM, I choose LA.

[AdvancedSetup]

@Poutnik

I fully understand what you mean and I cannot say if we will support it or not. It has been requested before as an enhancement but as you've seen from previous history that to date it has not been implemented. You are the first I've seen that wants it for Defrag as most want it for Backup Software needs.

All I can say is hang in there and hopefully some day we will implement it.

Cheers.

[Poutnik]

@Poutnik

I fully understand what you mean and I cannot say if we will support it or not. It has been requested before as an enhancement but as you've seen from previous history that to date it has not been implemented. You are the first I've seen that wants it for Defrag as most want it for Backup Software needs.

All I can say is hang in there and hopefully some day we will implement it.

Cheers.

Hi AdvancedSetup,

finally some reasonable person, I remember you well from the past.

Even if not satisfied with a status, I am very satisfied with such an answer.

[Poutnik]

Hi AdvancedSetup,

finally some reasonable person, I remember you well from the past.

Even if not satisfied with a status, I am very satisfied with such an answer.

I wonder why they hesitate so much to implement it. It is a simple operation, triggered for minor cases only.

Furthermore, such fix would increase performance on such systems.

Maybe for an opinion nobody should ever use it.

It reminds me fixing blinking bulb on a control panel

by either ignoring, covering or breaking a bulb, instead of fixing a problem behind.