Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to determine what the last operations performed on a windows XP machine, including the opening of files, applications, and any and all file manipulations (copy, cut paste) etc... ?

share|improve this question

migrated from Jan 1 '11 at 2:10

This question came from our site for professional and enthusiast programmers.

This type of investigation is usually called "forensics". You will find a lot of information in Google using that term. – Greg Hewgill Dec 31 '10 at 6:01
I also think (if set) there are some auditing service tools under the administrative tool in the control panel that you may be able to use to view such info.. (Been a while since i used windows so can't be exactly sure) – Dark Star1 Dec 31 '10 at 6:08

1 Answer 1

Please refer to windows event logs for details

share|improve this answer
event log contains only that info that is specifically logged there. You won't find info of all the open/accessed files there. – Vikram.exe Dec 31 '10 at 9:03
@Vikram File system accesses are audited based on Security ACLs set on file objects. These audited file system accesses are recorded in security event log – Neera Dec 31 '10 at 10:54
Thats fine, if auditing is turned on. Usually it is not. If auditing is not turned on, there won't be a record. The question also asked about cut/paste, for which I believe there is no way to get this information. – quickly_now Jan 1 '11 at 2:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.