Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to get a history of file operations in Windodws, like which folders were moved where, last renamed file, what was deleted, etc.?

share|improve this question
Try this freeware program: – eadmaster May 27 '12 at 21:34

There is no such log by default.

On a Windows NT system, an administrator can enable auditing of file operations:

Auditing settings for a directory


  1. For this to work, "Audit object access" must be enabled in secpol.msc:

    Secpol: Auditing

    The moment you turn it on, you will get flooded by miscellaneous object access logs.

  2. Audit logs of the entire filesystem will fill up the Security log really fast. I'm not going to talk about performance hits.

share|improve this answer

Process Monitor by SysInternals can monitor and log all file, registry and network operations.


You have to be careful though. In the screenshot above, even though it says CreateFile all access is read-only (libraries (DLLs) being loaded).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.