Recent PC activity

[LordGorzul]

I'm using XP Prof.
Basically I've had some people use my PC recently, and I'm worried they may have been sticking their noses where they shouldn't. I might be able to prove they did.

I know for a fact that there's a folder or log file in windows that keeps track of files/folders/programs opened, recent activity, but I'm not sure where to find it, can anyone help?

I'm not refering to the 'My Recent Documents' option under "Start" (which by the way doesnt even seem to work/refresh).

 

[stash]

I know for a fact that there's a folder or log file in windows that keeps track of files/folders/programs opened, recent activity, but I'm not sure where to find it, can anyone help?

Well, you can do auditing, but that has to be set up beforehand. I'm not aware of any such log that tracks things by default.

 

[LordGorzul]

Damn... I remember a friend being able to see exactly what I opened and saw on his Pc using some kind of Recent Document/folder.. He did it back on Win98, I remember it being in windows specifically and not a 3rd party software

 

[TXJustin]

I think it probably was the same data that you get from under the Start Menu. The folder itself is in Documents and Settings/%username%/recent.

 

[Umberger]

Originally posted by: TXJustin
I think it probably was the same data that you get from under the Start Menu. The folder itself is in Documents and Settings/%username%/recent.

i think this is the folder you are looking for. it is the data that the start menu folder is based upon, but it has a much longer history than the start menu

 

[NogginBoink]

Originally posted by: Umberger

Originally posted by: TXJustin
I think it probably was the same data that you get from under the Start Menu. The folder itself is in Documents and Settings/%username%/recent.

i think this is the folder you are looking for. it is the data that the start menu folder is based upon, but it has a much longer history than the start menu

That folder is maintained by the shell, and only documents opened by the shell will appear there.

If you want to know what files are being accessed, enable auditing on the objects you wish to audit, and review the security event log.