3

How can I see the dates history of when I accessed a file, beyond the latest time? This really means alot to me!

2 Answers 2

5

Windows has an audit mechanism that can track accesses to files, accessible via the Event Viewer.

First step : Set up auditing

Run secpol.msc, expand Local Policies and click Audit Policy. Double-click Audit Object Access, check Success and then OK.

Second step : Audit a folder

  • In Explorer, right-click the target file or folder, select Properties, then the Security tab.
  • Click Advanced, Auditing tab, and Continue.
  • Click the Add button, then Select a Principal. Type the name of a user or group into the field, click Check Names, and then OK.
  • Under Type, select Success
  • Under Applies to, select the object
  • Under Basic Permissions, select the ones to audit
  • Click OK as many times as required.

Third step : Consult logs

Run the Event Viewer, expand Windows Logs, then click Security, click on the right Filter Current Log, enter 4663 into the Event Ids field and click OK.

Note: The Security log is limited in size. To increase, in the Event Viewer, right-click the Security log and select Properties.

4

Without prior configuration you can't. Such information is not recorded by the filesystem. So if you want to check access times for some file on some PC that weren't configured for this, it's not possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .