Windows 10: How do I see what my friend was up to on my laptop?
How do I see what my friend was up to on my laptop?
I let my friend use my laptop today (windows 10) for about half an hour while I was out. Later when he had gone home, I went on to "recent files" in file explorer to continue writing a document I had been working on earlier. However, I discovered that there were no files there! (in recent files). Suspicious, I thought. Could This be explained by anything other than that my friend had accessed some files he shouldn't have and then tried to cover his tracks by clearing the "recent files" list? I have gone onto recent files since, and the documents I've opened appear there.
So my question is: How can I find out what files were accessed (not modified - but opened/accessed) over the last few hours/days? Bearing in mind that some may have been individually deleted (if he was extra sneaky) from the "recent files" list. If this method could show me apps which were recently run, I'd be extra appreciative.
Of course, "get better friends" is some good advice, but it's somthing for the future. What I want right now is information about today. I'd much appreciate your help!
Without frightfully expensive forensic analysis, I'm not sure you can.
How can I find out what files were accessed (not modified - but opened/accessed) over the last few hours/days?
At the very least, you might want to get some expert help scanning the system for possible malware.
If you do not trust this person, in the worst case scenario, one might have to assume that all the data on this computer have potentially been compromised.
If there are passwords, financial information and other sensitive data stored on it, then you might need to change all of your banking and other credentials from a different, known clean computer, and then wipe the drive and reinstall Windows.
What MoxieMomma said!
But you can take a look at temp folder (drive:Users\name\Local\Temp ). If he didn't cleaned up this folder, you could get some info from there. Far from everything, but some applications can leave an idea about what was going on. Get Quick View Plus application, I believe there is 30 days trial of it and take a look what is in there. Quick View Plus will show you file content regardless of current file extension (some .tmp files are really part of files that can be viewd...)
If he cleared temp files, than no luck with this...
Edit: Get Quick view plus from Softpedia, or you will have to provide personal info...
Windows doesn't log this kind of thing by default. File and folder access auditing would tell you want you want to know but this needs to be configured before the access. Logging this would have a serious impact on performance and produce large log files in a short period of time.
Your friend might have cleared things so their passwords and other personal information wasn't retained. It might not be anything you need to be suspicious about ... your answers will have to come from your friend - just ask "Did you clear things after you used my computer?"
The best advice I can offer is to set up a 2nd account (local / standard) to let other people use if you loan out your machine again.
The person can do what they need, but they can't affect your data and they can't change your machine.
It was nice of you to let your friend use your computer ... I don't even let me use mine
Exactly 3333 posts - is that real, or did you hack that somehow?
Click on the 3333 and on the list go back a few posts/replies.
Aw heck, 3333 was nothing .... this is much more difficult -->
How can i do that?
VPN, VLAN, Proxy would work?
My friend wants to build new PC & he asked me to help with building & I built this system so far, but problem is, I fell behind all these hardware stuff & I'm not sure if I did that build right. I mean if there is anything incompatible, can you...
What are the steps to upgrade/keep files? And will it activate if it is done clean by deleting all partitions and installing thereafter.
Hey everyone, so my friend and I updated Windows 7 to Windows 10 today. We have set up Cortana, but mine acts differently than his. When I say "Hey Cortana" she responds with a beep, and then I can ask questions. However, my friend can start a...
I have 8.1. For future reinstallation, I downloaded and burned an ISO from here: http://windows.microsoft.com/en-us/windows-8/create-reset-refresh-media
What I want to know is if this will work for a friend's computer and I can just use his...