[unisog] Do Windows file access, file mod, file create timestamps lie?

[Mike Lococo]

> The first is about how NTFS works and tells why the last access
> time may be up to an hour off.
...
> http://technet2.microsoft.com/windowsserver/en/library/8cc5891d- 
> bf8e-4164-862d-dac5418c59481033.mspx

What do you make of this line:

    "File-based queries of Last Access Time are accurate even if
    all on-disk values are not current. NTFS returns the correct
    value on queries because the accurate value is stored in memory.

My reading of it (and my gut-instinct about how things _should_ work) is 
that one should never see the stale last access times unless one is 
somehow doing raw disk reads or is examining a filesystem that wasn't 
unmounted cleanly.

> The second is a link to the registry that turns off last access times  
> to speed up the filesystem because the action of reading a file would  
> actually cause a write to the filesystem since it has to update the  
> timestamp. In Vista, the key is present and set to 1 to turn off  
> updates. If you've got any XP and Vista systems, compare them and  
> you'll see.

I reproduced the results on a Windows XP system that has no 
NtfsDisableLastAccessUpdate key, which should handle last access times 
normally.

Thanks,
Mike Lococo