Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to determine what the last operations performed on a windows XP machine, including the opening of files, applications, and any and all file manipulations (copy, cut paste) etc... ?

share|improve this question

migrated from stackoverflow.com Jan 1 '11 at 2:10

This question came from our site for professional and enthusiast programmers.

    
This type of investigation is usually called "forensics". You will find a lot of information in Google using that term. –  Greg Hewgill Dec 31 '10 at 6:01
    
I also think (if set) there are some auditing service tools under the administrative tool in the control panel that you may be able to use to view such info.. (Been a while since i used windows so can't be exactly sure) –  Dark Star1 Dec 31 '10 at 6:08

1 Answer 1

Please refer to windows event logs for details

share|improve this answer
    
event log contains only that info that is specifically logged there. You won't find info of all the open/accessed files there. –  Vikram.exe Dec 31 '10 at 9:03
    
@Vikram File system accesses are audited based on Security ACLs set on file objects. These audited file system accesses are recorded in security event log –  Neera Dec 31 '10 at 10:54
    
Thats fine, if auditing is turned on. Usually it is not. If auditing is not turned on, there won't be a record. The question also asked about cut/paste, for which I believe there is no way to get this information. –  quickly_now Jan 1 '11 at 2:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.