up vote 2 down vote favorite
share [g+] share [fb]

how can I tell if someone has been in my laptop & what files they have looked at?

link|improve this question
4  
The only way to (realistically) do this is by installing software beforehand. – Hello71 Aug 11 '10 at 17:27
feedback

4 Answers

up vote 4 down vote

Like Hello71 said, after the fact there's not a way to do this. You need to install monitoring software beforehand. Alternatively, pick a new password and use a strong password to prevent this from happening in the first place.

link|improve this answer
1  
You can look at the login times and also file access times. If you weren't using your computer at that time, it's likely that someone else was using your computer during that time. – user13743 Aug 11 '10 at 18:20
feedback
up vote 3 down vote

You could check the event log called Security for logins that occured.

To indicate which files they have looked at you could enable NTFS Last Access, then search for the last accessed files using disk view software or searching for all files on your PC and sort by column.

A lot of software also show the recent files that have been viewed so that might be another place to look.

link|improve this answer
1  
IIRC except in Vista (SP0?) NTSF Last Access is disabled by default because of the performance hit it imposes on disk IO; so most likely that would only be useful for monitoring future attacks not for anything that has happened in the past. – Dan Neely Aug 11 '10 at 17:51
feedback
up vote 2 down vote

Usage of certain applications will leave behind files with time/date stamps.

Take a look at your web browser history, cookies and cache. See if anything was updated in the timeframe you are concerned about. This addon will let you examine the Firefox cache https://addons.mozilla.org/en-US/firefox/addon/2489/

Opening files in MS Office application often leave temporary files behind.

Go to the temporary directories inside c:\Documents and Settings\ACCOUNTNAME and see if any files were created/updated.

The event viewer records a variety of system, security and application events. Check here for records of application starts, boot up events, application errors/crashes.

As for telling what files were opened, if they happen to be MS Office files, as mentioned above you might be able to see some temp files,

link|improve this answer
feedback
up vote 2 down vote

There are a lot of possible evidences you can look for:

  • You can search files that was changed in the time interval you suspect your computer was accessed.
  • You can see the "Recent documents" folder
  • You can see Event Viewer logs
  • You can even ask for you e-mail service provider for access logs of your account (Gmail provides this information. In the bottom of the page there is a link called "Details" that can show you recent account activity)
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.