Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to get a history of file operations in Windodws, like which folders were moved where, last renamed file, what was deleted, etc.?

share|improve this question
    
Try this freeware program: trisunsoft.com/windows-explorer-tracker –  eadmaster May 27 '12 at 21:34

2 Answers 2

There is no such log by default.


On a Windows NT system, an administrator can enable auditing of file operations:

Auditing settings for a directory

However:

  1. For this to work, "Audit object access" must be enabled in secpol.msc:

    Secpol: Auditing

    The moment you turn it on, you will get flooded by miscellaneous object access logs.

  2. Audit logs of the entire filesystem will fill up the Security log really fast. I'm not going to talk about performance hits.

share|improve this answer

Process Monitor by SysInternals can monitor and log all file, registry and network operations.

procmon.exe

You have to be careful though. In the screenshot above, even though it says CreateFile all access is read-only (libraries (DLLs) being loaded).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.