I have an open notepad file on my machine which I don't recall making. Is there a way I can determine what time and day the file was created (registry key or whatnot)? I haven't saved it yet because I don't want to muck up any file stamps, registry entries, etc. So, to be clear, right now, it's "Untitled - Notepad".

  • Just FYI, it's not a file. Files exist only on storage devices. Unless you have saved it, it's just a bunch of zeros and ones somewhere in RAM. – gronostaj Apr 8 '13 at 19:43
  • Good distinction... – uniquegeek Apr 8 '13 at 20:16

You can use Process Explorer to see what time the Notepad was launched.

Right click on the process and select Properties.... notepad properties in process explorer

  • seems the prefetch will also hold last run data for the program forensicswiki.org/wiki/Prefetch An untitled notepad item, is usually unsaved, so there is no "file" yet, its not Word where autosaves, and backups and all would exist. – Psycogeek Apr 8 '13 at 19:31
  • @Psycogeek good point, I was confused on that as well. – Austin T French Apr 8 '13 at 19:32
  • 1
    Thanks for all your help folks; that got me what I needed, plus related notes that'll improve my skills! – uniquegeek Apr 8 '13 at 20:18
  • @Louis, Can Task Manager do the same thing? Or are we forced to download Process Explorer? – Pacerier Nov 19 '14 at 9:42
  • @Pacerier I don't see it as one of the available columns in the details pane... You don't have to use ProcessExplorer though. Seems available in the System.dll assembly, and here in PowerShell: Get-Process | Select-Object name,starttime – Louis Nov 19 '14 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.