Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just found out that someone went snooping through my computer a few days ago. I want to know if there is a way to see exactly what files (documents/pictures) that they opened.

I tried adding the "Date visited" header in windows explorer but that doesn't have any data. The "Date Accessed" header only seems to store the time when the file was created.

Another possible solution which I tried was using RecentFilesView. This program does what I need but it only lists up to 138 files.

Any help would be greatly appreciated.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Well, if they were just browsing your computer, then you are out of luck. NTFS has a "last accessed" attribute, but it is disabled by default on Windows 7. If they changed any files, they would be located under the Date modified. Where were these files located? What kind of permissions are available (ACL)?

Windows DOES by default keep a log of every time a user logs in, unlocks the computer, etc. It would be under the Event Viewer's Audit Log.

share|improve this answer
    
The files are all located on my 'Local C' drive. I only have 1 user who is an admin so they had full permissions and the computer was already logged in when they went on it. –  tvguide1234 Jul 1 '11 at 22:48
    
Not locked admin account. Game over. Nothing else I can think of by default. Tips for next time? Lock the computer. Window key + L is the shortcut. You can also use the Power Settings to have the computer lock when the monitor goes to sleep. I hope nothing disastrous comes out of this. –  surfasb Jul 1 '11 at 23:08
    
Ah damn alright. I'll leave it up for a day few hours to see if anyone else has any ideas. Thanks for the help though! –  tvguide1234 Jul 1 '11 at 23:13
1  
Sucks that the "Last access" is off by default for ya. I remember when Microsoft made that decision on Technet. They reasoned that it confused a lot of customers because they were unaware what and why it would change. You would essentially have to give a 2 hour lecture to explain all the possible outcomes on why it would change. Plus it started to affect performance as hard drive sizes ballooned. –  surfasb Jul 1 '11 at 23:21
add comment

On any given folder, in the right pane, right click on the name header and select "more...", then scroll down to "Date Accessed" and tick the box, it will now show the date and time if any thing was written, changed or deleted from the folder (write), it will not show if it was just opened and looked at (read), something has to change for the date to be updated. This will not show you who accessed it, it could be a user or the system itself.

enter image description here

.

enter image description here

To enable Last Accessed (which will time stamp for a read and write), open an elevated command prompt and type this i and hit Enter

There will be a system performance hit if you enable it.

 fsutil behavior set disablelastaccess 0

To disable it

 fsutil behavior set disablelastaccess 1
share|improve this answer
    
Just to confirm, this wouldn't show me any information if someone just browsed through my pictures without changing anything correct? –  tvguide1234 Jul 4 '11 at 4:12
    
The first method, no, the second yes, but has to be enabled Before the snoop looked at files. If they opened the pictures in some sort of viewer it may change the "date accessed" time stamp, have not verified this. –  Moab Jul 4 '11 at 13:41
    
Last accessed time is disabled by default on Windows 7. Plus, opening a picture in some sort of viewer or getting a preview through Explorer WILL change the time. technet.microsoft.com/en-us/library/cc781134(WS.10).aspx –  surfasb Jul 5 '11 at 7:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.