Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an open notepad file on my machine which I don't recall making. Is there a way I can determine what time and day the file was created (registry key or whatnot)? I haven't saved it yet because I don't want to muck up any file stamps, registry entries, etc. So, to be clear, right now, it's "Untitled - Notepad".

share|improve this question
    
Just FYI, it's not a file. Files exist only on storage devices. Unless you have saved it, it's just a bunch of zeros and ones somewhere in RAM. –  gronostaj Apr 8 '13 at 19:43
    
Good distinction... –  uniquegeek Apr 8 '13 at 20:16

1 Answer 1

up vote 7 down vote accepted

You can use Process Explorer to see what time the Notepad was launched.

Right click on the process and select Properties.... notepad properties in process explorer

share|improve this answer
    
seems the prefetch will also hold last run data for the program forensicswiki.org/wiki/Prefetch An untitled notepad item, is usually unsaved, so there is no "file" yet, its not Word where autosaves, and backups and all would exist. –  Psycogeek Apr 8 '13 at 19:31
    
@Psycogeek good point, I was confused on that as well. –  AthomSfere Apr 8 '13 at 19:32
1  
Thanks for all your help folks; that got me what I needed, plus related notes that'll improve my skills! –  uniquegeek Apr 8 '13 at 20:18
    
@Louis, Can Task Manager do the same thing? Or are we forced to download Process Explorer? –  Pacerier Nov 19 at 9:42
    
@Pacerier I don't see it as one of the available columns in the details pane... You don't have to use ProcessExplorer though. Seems available in the System.dll assembly, and here in PowerShell: Get-Process | Select-Object name,starttime –  Louis Nov 19 at 10:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.