Activity recorded in computer

Posted on 2006-05-13
Medium Priority
Last Modified: 2010-04-11
I am trying to find out the activity of a work computer - a previous employee came  back to the office (after being fired 3 months ago) and was at the cmputer for 1 1/2 hours. (brave girl....)

Is there anyway that I can find out what her activity was?  I know the date and time of her being there....but did she copy any files to a floppy or removable disk?

I know how to check History, cookies, etc.  but I would like to know if other activity occurred.  any help is most appreciated!!

Also, can I recover files that were deleted from the recycle bin?
Question by:SuperCPlus
LVL 97

Accepted Solution

war1 earned 1400 total points
ID: 16676188
Greetings, SuperCPlus !

Look at the Event Viewer to see what had occurred during the period of time

To recover deleted files, use one or more these undelete utilities

FreeUndelete        http://officerecovery.com/freeundelete/index.htm
PC Inspector        http://www.pcinspector.de/file_recovery/UK/welcome.htm
Restoration            http://www.snapfiles.com/get/restoration.html              
Active Undelete        http://www.snapfiles.com/get/activeundelete.html
Flash Recovery        http://www.snapfiles.com/get/smartrecoverontracky.html
TestDisk & utilities    http://www.cgsecurity.org

Recovery My Files        http://www.recovermyfiles.com/
GetDataBack            http://www.runtime.org/      
Stellar            http://www.stellarinfo.com/            
Restorer 2000        http://www.bitmart.net/
Ontrack            http://www.ontrack.com/
Easy Recovery        http://www.ontrack.com/easyrecoveryprofessional/
Zero Assumption        http://www.z-a-recovery.com/setup.exe

Best wishes!
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 400 total points
ID: 16676344
Unless you had something installed to assist you with these types of things... there isn't much your likely to find. By default windows event log records only the very minimum of occurances. If she used IE to view the web you can see where she visited, but not what she typed. Your pretty much out of luck, windows doesn't log file copies, moves or even deletions by default. It can record those things, but you have to turn those settings on before anything happens. Pretty much, only errors are logged by windows.
LVL 51

Assisted Solution

ahoffmann earned 100 total points
ID: 16677649
if you have not activated some kind access control before, ther is not much to find out
doing some forensics just may identify deleted o changed files

Assisted Solution

HyeProfile earned 100 total points
ID: 16678722
btw, to access the built-in windows event viewer:
start menu... run...
type "eventvwr"...

Author Comment

ID: 16679555
Thanks so much for your help and quick responses!  

I was able to view the temp internet files and cookies to track some activity during that period.....and also recover some files from the recycle bin (nothing significant) - thanks War1 for your links!

I did look at the event viewer - but no information of interest.  In the future, it would have been nice to have some activity recorded - don't know if files were transferred to a flash drive or floppy....but the answer for this particular situation....is NOT let anyone on the computers that is not an employee....save a little worry.....and time...

Thanks again!


Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is about my experience upgrading my consulting machine to Windows 10 Version 1709 (The Fall 2017 Creator Update)
This blog will spread awareness about Dropbox. We have given the statements based upon our experience. Along with this, there is a section of some new plans that should be added in Dropbox this year. This will make the storage service enhanced from …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question