How can I see the dates history of when I accessed a file, beyond the latest time? This really means alot to me!
2 Answers
Windows has an audit mechanism that can track accesses to files, accessible via the Event Viewer.
First step : Set up auditing
Run secpol.msc
, expand Local Policies and click Audit Policy.
Double-click Audit Object Access, check Success and then OK.
Second step : Audit a folder
- In Explorer, right-click the target file or folder, select Properties, then the Security tab.
- Click Advanced, Auditing tab, and Continue.
- Click the Add button, then Select a Principal. Type the name of a user or group into the field, click Check Names, and then OK.
- Under Type, select Success
- Under Applies to, select the object
- Under Basic Permissions, select the ones to audit
- Click OK as many times as required.
Third step : Consult logs
Run the Event Viewer, expand Windows Logs, then click Security,
click on the right Filter Current Log, enter 4663
into the Event Ids field
and click OK.
Note: The Security log is limited in size. To increase, in the Event Viewer, right-click the Security log and select Properties.
Without prior configuration you can't. Such information is not recorded by the filesystem. So if you want to check access times for some file on some PC that weren't configured for this, it's not possible.