Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if there is any way to check what files where burned to what CD/DVD from a Windows 7 computer?

In other words, is there a log function which records what files where burned to disk?

If this is the case, does it record what actually has been burned or does it only state that a new "CD project" has been created with a list of files?

Other info:

  • Burning method -> Live File System
  • Hardware -> External DVD-RW drive (sorry all I know)
  • OS -> Windows 7 (probably Professional)
  • Both the user burning and the user looking for the history are administrators.
share|improve this question
4  
That would be fun for computer crime forensics. – Daniel Beck Dec 10 '10 at 19:54
up vote 3 down vote accepted

I don't believe that Windows (any version) saves a history of the files burned to disk. I goggled around for a few minutes and didn't come up with any proof that it does. I have a background in computer forensics, and have never heard this mentioned as a technique. The only way it may record anything is if in the process of burning the files to CD windows considered those files as being accessed and maybe put those in the recent items list [C:\Users(User Name)\AppData\Roaming\Microsoft\Windows\Recent Items], and/or if the accessed/modified date is changed on the file itself.

Most likely though there's no history, but give it a try and see if the files show up in that directory or the access date changes.

share|improve this answer
    
I have looked everywhere and there is no way of telling what has been burned to a disc or not. Even if the files where to be found in the tmp-dir this is not proof of them being burned to an external disc. – ABeanSits Dec 13 '10 at 11:19

Only if the application that created the CD saves a log of its own or writes information to the Windows system logs. Windows itself does not natively store this information, no.

share|improve this answer
    
notice he mentioned the burning method was Live File System. – Daisetsu Dec 10 '10 at 23:51

Lumension or similar product can log what has been copied to USB, external harddrives, CDs and DVDs. But that would be more of an enterprise solution.

share|improve this answer

Based on skimming the below resources it does sound plausible that one could determine what files where burned to a CD/DVD.

In short, using a query (see below) you can obtain the CD/DVD burning service starting, running for several minutes, and shutting down. The usefulness of this information can be correlated with other kinds of artifacts, based on time stamps. Through testing of the burning process and close examination of the artifacts from the master file table, use those markers that have been found (associated with copying or “burning” files to CD or DVD) and compare it with data pulled from the query.

Resources:

(note: I previously released this answer but only with reference pointing to info. I have updated my response with an answer but also including the references this was derived from for ones further research).

Query (excerpt from resource #1):

To obtain only the time and message for all non-duplicate events during a two-week period beginning 3/1/2006, the fol- lowing query might be used:

LogParser "SELECT DISTINCT TimeGenerated, Message INTO 2006-03-01to03-15.tsv FROM goodlogs/*.evt WHERE TimeGenerated > '2006-03-01 00:00:00’ AND TimeGenerated < ‘2006-03-15 00:00:00’ ORDER BY TimeGenerated"

To get all messages during this period showing operation of the CD burning service, the following might be used:

LogParser ‘‘SELECT DISTINCT TimeGenerated, Message INTO 2006-03-01to03-15.tsv FROM goodlogs/*.evt WHERE TimeGenerated > ‘2006-03-01 00:00:00’ AND TimeGenerated < ‘2006-03-15 00:00:00’ AND Message LIKE ‘%CD-Burning%’ ORDER BY TimeGenerated"
share|improve this answer
1  
This answer is still not a very good answer. You don't provide specific details to collect this information. You talk about "a query" but don't indicate how to perform that query. So you are left with a bunch of random links. – Ramhound Feb 3 at 20:57
    
I have updated the article to include the query, Thanks @Ramhound – Tek'eek Feb 5 at 17:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.