5

I just found out that someone went snooping through my computer a few days ago. I want to know if there is a way to see exactly what files (documents/pictures) that they opened.

I tried adding the "Date visited" header in windows explorer but that doesn't have any data. The "Date Accessed" header only seems to store the time when the file was created.

Another possible solution which I tried was using RecentFilesView. This program does what I need but it only lists up to 138 files.

Any help would be greatly appreciated.

Improve this question

3 Answers 3

Reset to default
2

Well, if they were just browsing your computer, then you are out of luck. NTFS has a "last accessed" attribute, but it is disabled by default on Windows 7. If they changed any files, they would be located under the Date modified. Where were these files located? What kind of permissions are available (ACL)?

Windows DOES by default keep a log of every time a user logs in, unlocks the computer, etc. It would be under the Event Viewer's Audit Log.

Improve this answer
4
  • The files are all located on my 'Local C' drive. I only have 1 user who is an admin so they had full permissions and the computer was already logged in when they went on it.
    – tvguide1234
    Jul 1, 2011 at 22:48
  • Not locked admin account. Game over. Nothing else I can think of by default. Tips for next time? Lock the computer. Window key + L is the shortcut. You can also use the Power Settings to have the computer lock when the monitor goes to sleep. I hope nothing disastrous comes out of this.
    – surfasb
    Jul 1, 2011 at 23:08
  • Ah damn alright. I'll leave it up for a day few hours to see if anyone else has any ideas. Thanks for the help though!
    – tvguide1234
    Jul 1, 2011 at 23:13
  • 2
    Sucks that the "Last access" is off by default for ya. I remember when Microsoft made that decision on Technet. They reasoned that it confused a lot of customers because they were unaware what and why it would change. You would essentially have to give a 2 hour lecture to explain all the possible outcomes on why it would change. Plus it started to affect performance as hard drive sizes ballooned.
    – surfasb
    Jul 1, 2011 at 23:21
3

On any given folder, in the right pane, right click on the name header and select "more...", then scroll down to "Date Accessed" and tick the box, it will now show the date and time if any thing was written, changed or deleted from the folder (write), it will not show if it was just opened and looked at (read), something has to change for the date to be updated. This will not show you who accessed it, it could be a user or the system itself.

enter image description here

.

enter image description here

To enable Last Accessed (which will time stamp for a read and write), open an elevated command prompt and type this i and hit Enter

There will be a system performance hit if you enable it.

 fsutil behavior set disablelastaccess 0

To disable it

 fsutil behavior set disablelastaccess 1
Improve this answer
4
  • Just to confirm, this wouldn't show me any information if someone just browsed through my pictures without changing anything correct?
    – tvguide1234
    Jul 4, 2011 at 4:12
  • The first method, no, the second yes, but has to be enabled Before the snoop looked at files. If they opened the pictures in some sort of viewer it may change the "date accessed" time stamp, have not verified this.
    – Moab
    Jul 4, 2011 at 13:41
  • Last accessed time is disabled by default on Windows 7. Plus, opening a picture in some sort of viewer or getting a preview through Explorer WILL change the time. technet.microsoft.com/en-us/library/cc781134(WS.10).aspx
    – surfasb
    Jul 5, 2011 at 7:04
  • Does anyone know how much of a performance hit this is? I understand this is a relative and depends kind of question. The benefits seem to be a good thing but does it out weight the performance hit?
    – yedevtxt
    Feb 14, 2017 at 14:54
0

If you had Last Access updates disabled, you're out of luck.

But if it was enabled, you should find a file search software that can search by this attribute.

As an alternative, SwiftSearch can give you a list of all files on a disk in a matter of seconds, then you sort by clicking on the "Accessed" column and scroll to the needed time.

If you're trying to detect actions of a malicious software, chances are it's smart enough not to leave traces. An aware user could also try to hide his activity by disabling and reenabling the feature or overwriting the Last Accessed timestamp with an old date post factum.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .