Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

how can I tell if someone has been in my laptop & what files they have looked at?

share|improve this question
The only way to (realistically) do this is by installing software beforehand. – Hello71 Aug 11 '10 at 17:27

Like Hello71 said, after the fact there's not a way to do this. You need to install monitoring software beforehand. Alternatively, pick a new password and use a strong password to prevent this from happening in the first place.

share|improve this answer
You can look at the login times and also file access times. If you weren't using your computer at that time, it's likely that someone else was using your computer during that time. – user13743 Aug 11 '10 at 18:20

You could check the event log called Security for logins that occured.

To indicate which files they have looked at you could enable NTFS Last Access, then search for the last accessed files using disk view software or searching for all files on your PC and sort by column.

A lot of software also show the recent files that have been viewed so that might be another place to look.

share|improve this answer
IIRC except in Vista (SP0?) NTSF Last Access is disabled by default because of the performance hit it imposes on disk IO; so most likely that would only be useful for monitoring future attacks not for anything that has happened in the past. – Dan Neely Aug 11 '10 at 17:51

Usage of certain applications will leave behind files with time/date stamps.

Take a look at your web browser history, cookies and cache. See if anything was updated in the timeframe you are concerned about. This addon will let you examine the Firefox cache

Opening files in MS Office application often leave temporary files behind.

Go to the temporary directories inside c:\Documents and Settings\ACCOUNTNAME and see if any files were created/updated.

The event viewer records a variety of system, security and application events. Check here for records of application starts, boot up events, application errors/crashes.

As for telling what files were opened, if they happen to be MS Office files, as mentioned above you might be able to see some temp files,

share|improve this answer

There are a lot of possible evidences you can look for:

  • You can search files that was changed in the time interval you suspect your computer was accessed.
  • You can see the "Recent documents" folder
  • You can see Event Viewer logs
  • You can even ask for you e-mail service provider for access logs of your account (Gmail provides this information. In the bottom of the page there is a link called "Details" that can show you recent account activity)
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .