Results 1 to 11 of 11
  1. #1
    4 Star Lounger
    Join Date
    Feb 2006
    Location
    Cape Cod, Massachusetts, USA
    Posts
    408
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Trail of file viewing (XP home SP2)

    A friend just asked me if one can determine what files may have been recently viewed on his system. He was away for several days and the computer was found ON when he returned. He does not have his computer password protected - I think he will now. Turns out a relative had dropped by unexpectedly. The only diagnostic I know about is to turn on the date-accessed column in windows explorer. As I recall this is rather non specific as it seems to indicate when a folder was accessed and gives the date/time attribute to all the files in that folder. Are there other utilities or places to look for recent activity? I believe his system is XP home edition, SP2.

    Paul

  2. #2
    Uranium Lounger viking33's Avatar
    Join Date
    Jun 2002
    Location
    Cape Cod, Massachusetts, USA
    Posts
    6,308
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Trail of file viewing (XP home SP2)

    Paul,
    The first things that come to mine ( if they haven't been erased ) is in Documents and Settings>User name>Local Settings, then look in the History, Temp & Temporary Internet files folders.

    Also in My documents and My Recent Documents folders. They may give you some clue to what activity has taken place.
    BOB
    http://lounge.windowssecrets.com/S/flags/USA.gif http://lounge.windowssecrets.com/S/f...sachusetts.gif


    Long ago, there was a time when men cursed and beat on the ground with sticks. It was called witchcraft.
    Today it is called golf!

  3. #3
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: Trail of file viewing (XP home SP2)

    There's the History button in IE and the recently viewed file list in all MS Office programs at the end of the File menu. Any file in particular that your friend is concerned about can be checked for when it was last accessed by checking it's properties. HTH
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  4. #4
    4 Star Lounger
    Join Date
    Feb 2006
    Location
    Cape Cod, Massachusetts, USA
    Posts
    408
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Trail of file viewing (XP home SP2)

    Excellent Bob !
    I think that history log should provide him with exactly what he needs.

    Thanks,
    Paul

  5. #5
    4 Star Lounger
    Join Date
    Feb 2006
    Location
    Cape Cod, Massachusetts, USA
    Posts
    408
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Trail of file viewing (XP home SP2)

    Doc,
    He is not concerned with browser activity. Rather he is concerned with text and spread sheet files that contain personal information that may have been opened. The recently viewed file list would be of some help. I will add that to the list of things to check.

    Thanks,
    Paul

  6. #6
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Trail of file viewing (XP home SP2)

    Even if he is not interested in browser activity, I think that what Doc mentioned is a good place to check; the History in IE will, under My computer, show any types of files, text or spreadsheet etc. As long as it hasn't been deleted.

    On the other hand, the IE History button is the same thing as Bob mentioned: Documents and Settings<User name>Local SettingsHistory.

    As to Bob's advice with My Recent Documents, good advice:

    But if your friend have, for example, a file he usually opens and work on, then it may be found in the Recent Documents list on Start menu. Nothing odd, at first, if it's still there later, if one only looks for new files added to the list that were not there before. But if he opens Documents and Settings<User name>My Recent Documents and look at the link's properties for latest used date and time, it may show when the link on the Start menu Recent Document was used.

    So, if he use the list, hadn't deleted it, and don't find any new files on it, he can look at the properties for the links.

  7. #7
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Trail of file viewing (XP home SP2)

    Added:
    "As I recall this is rather non specific as it seems to indicate when a folder was accessed and gives the date/time attribute to all the files in that folder."

    Don't think it gives the date/time attribute to all the files in that folder.

    A simple start would be to run a general file search, with WinExplorer from Start menu, (and now I don't know how he has his "Search companion" set up (std/classic etc)), select to search between some dates, and select latest change/created/used, then maybe add some column in search result, and just click them to sort result.

  8. #8
    4 Star Lounger
    Join Date
    Feb 2006
    Location
    Cape Cod, Massachusetts, USA
    Posts
    408
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Trail of file viewing (XP home SP2)

    Bob, Doc, Argus

    I just returned from my friend's house and found a consistent set of information using the approaches suggested by all. The computer was used twice in the last two weeks while he was away and both times the only activity recorded was Internet activity. No one should have been in the house during his absence, but that is now a family/social issue and not one of having any of his personal/local data compromised.

    The IE history lists files opened under My Computer, but at least with his settings if the date is say two weeks ago no date/time data is presented. If it was just a few days ago the day folder specifies the date.
    The History folder (documents and Settings<User name>Local SettingsHistory) on the other hand specifies the date and time for the entire log. Likewise, the My recent documents contains the date and time info for all files.

    Looking at specific files of interest to him using internet explorer with "date accessed" turned on showed no activity while he was away. I have not had time to explore this, but I have been able to modify the date accessed data for all files in a folder by operating on only one file. I can certainly change the date access data for an entire group of sub folders by one action. Some little issue here I have to understand at some point.

    In any case, thanks to all inputs a friend is more comfortable now with the unauthorized access he experienced on his computer.

    Paul

  9. #9
    Plutonium Lounger
    Join Date
    Oct 2001
    Location
    Lexington, Kentucky, USA
    Posts
    12,107
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Trail of file viewing (XP home SP2)

    Sounds like someone is probably gonna end up saying: "...Aw jeez Dad, I forgot to tell you that..."

  10. #10
    4 Star Lounger
    Join Date
    Feb 2006
    Location
    Cape Cod, Massachusetts, USA
    Posts
    408
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Trail of file viewing (XP home SP2)

    Probably more like "Aw jeez Grandpa I didn't think you would mind if I crashed here while you were away." Apparently, this is not the first issue with this twenty-something.

    Paul

  11. #11
    Plutonium Lounger
    Join Date
    Oct 2001
    Location
    Lexington, Kentucky, USA
    Posts
    12,107
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Trail of file viewing (XP home SP2)

    Oh yeah, I've been down that road before. The reason I said Dad is that our only son is the ONLY one with a key to the house and I have experienced situations similar to your story! Kids - can't live with 'em or without 'em, huh?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •