1

Is there a way to see the activity log of the hard drive, like when do I open the hard drive and files, regarding that my Windows crashes and I reinstalled the Windows, so now all the log are deleted or there is a way to find out if someone opened my files ?

I have already tried to view the activity log of the Windows but it shows the activity of the new Windows installed

Improve this question

3 Answers 3

Reset to default
0

What you're looking for is commonly refered to as filesystem auditing, which is available by default in some systems like Linux but usually on Windows people use third party software. You can see this technet article for how to achieve it in server versions of Windows: https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

Improve this answer
2
  • 1
    Filesystem auditing is available on Windows client editions. On Windows 7 and later it is very easy to enable auditing of file system activity for all files. On earlier versions you would have to enable it on a per-file or -directory basis, which is tedious but doable.
    – Jamie Hanrahan
    Jul 29, 2017 at 0:51
  • 1
    Thanks, I see the Windows 7+ reference on technet now that i look. technet.microsoft.com/en-us/library/dn319056(v=ws.11).aspx
    – mikebabcock
    Aug 1, 2017 at 18:56
0

Windows does not by default log file system activity. And even if it had been doing so on your previous installation, your formatting the hard disk and reinstalling Windows would have overwritten the previous audit logs. Sorry about that.

Improve this answer
0

Just use Windows Performance Monitor + Windows Performance Analyzer (= Windows Performance Toolkit)

Search for it either using general search engine on the internet, or using Windows App Store. Help is also online.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy