up vote 0 down vote favorite
share [g+] share [fb]

Is there a way to determine what the last operations performed on a windows XP machine, including the opening of files, applications, and any and all file manipulations (copy, cut paste) etc... ?

link|improve this question
This type of investigation is usually called "forensics". You will find a lot of information in Google using that term. – Greg Hewgill Dec 31 '10 at 6:01
I also think (if set) there are some auditing service tools under the administrative tool in the control panel that you may be able to use to view such info.. (Been a while since i used windows so can't be exactly sure) – Dark Star1 Dec 31 '10 at 6:08
feedback

migrated from stackoverflow.com Jan 1 '11 at 2:10

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 2 down vote

Please refer to windows event logs for details

link|improve this answer
event log contains only that info that is specifically logged there. You won't find info of all the open/accessed files there. – Vikram.exe Dec 31 '10 at 9:03
@Vikram File system accesses are audited based on Security ACLs set on file objects. These audited file system accesses are recorded in security event log – Neera Dec 31 '10 at 10:54
Thats fine, if auditing is turned on. Usually it is not. If auditing is not turned on, there won't be a record. The question also asked about cut/paste, for which I believe there is no way to get this information. – quickly_now Jan 1 '11 at 2:23
feedback

Your Answer

 
or
required, but never shown
discard