Is there any historical information stored in Windows 7 that would allow me to see if files from the machine have been saved to a hard-disk or memory key recently?
1 Answer
Most, if not all, NT versions of Windows (NT4.0, 2000, XP, Vista, 7) have auditing capability. It's not enabled by default.
So there is nothing that can be done now unless you look in the accounts Recent documents and look there for recently accessed files. For the future however, you might want to look into Windows auditing capabilites or a third party utility.
This explains what is needed to enable auditing - you basically need to go into Local Security Policy in Control Panel -> Administrative Tools, drill down to Local Policy -> Audit Policy, and enable Audit Object Access.
Once that is done, an "Auditing" tab is visible next to the Security tab if you right click any file or folder. There you can enable auditing for that file or folder. I believe you can do it for a drive root.
You can then go to Administrative Tools -> Event Viewer -> Windows Logs to view the audits.
Of course this requires you configure the audit settings when the drive is inserted.
There might be a way to enable auditing by default for removable media but I'm not aware of how to do that from within Windows. While researching this answer I found this forum post that mentions a third party program that can do this. I haven't tried it.