Note that under "relatime" atimes will also be updated if the current atime is more than 24hrs old. The upshot is that atime often indicates the FIRST time a program is executed during an incident, rather than the last time as we would infer when atimes were updated every access.