5

I am running Windows 7, and I have a mapped network drive. Is there any way to examine a file on that drive and find out who was the last user who modified it? If so, how can I do this?

Improve this question
2
  • 1
    You may potentially be able to do this using the Security Event Log, but you'll be making assumptions about the fact that the last person to access the share is the one who modified it. That's off the top of my head.
    – user3463
    Jan 25, 2011 at 22:56
  • 1
    If it was Windows Server, you could have used file auditing, which is exactly for this.
    – paradroid
    Jan 25, 2011 at 23:14

2 Answers 2

Reset to default
2

Sorry, only the modification date is logged by Windows 7.

You only can achieve this with logging, there are two options:

  • Keep using the network shares, set up Process Monitor to log the file events on the network share.

  • Go for a different protocol like a Filezilla Server, you could look backwards in the FTP logs.

Don't forget to read Randolph's Comment on your question, it allows you to get the name given the date.

Improve this answer
3
  • I don't have any direct control over the server so the Process Monitor and Filezilla Server are probably out of the question. Thanks anyway.
    – Elias Zamaria
    Jan 25, 2011 at 23:04
  • @mikez302: I see, I'm not aware of any client-side solutions. An option is to Wireshark the network traffic, but that might not be legal unless you are a network/system administrator.
    – Tamara Wijsman
    Jan 25, 2011 at 23:07
  • 1
    That is probably not worth the hassle and legal trouble. I was wondering if there was a simple way.
    – Elias Zamaria
    Jan 25, 2011 at 23:14
0

If you are working with Microsoft Office products you can click File and then you can see on the bottom Right "Last Modified By" [Name].

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .