Access to user login data and info

I have been given a drive from a failed PC, and asked to investigate as much as possible the last user login, audit trail, and if possible pages visited in IE.
To get access to the drive, I have mounted it as an external drive and now have access to the "failed" device.
My question is where would I find the:
the last user login,
audit trail of data worked on
and if possible pages visited in IE.

Looking for as much info to check this out.

Many thanks in advance.
gavin_dAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

FOXActive Directory/Exchange EngineerCommented:
Gavin,
To view the IE history follow this link for the path according to the OS that was used
http://www.forensicswiki.org/wiki/Internet_Explorer_History_File_Format

Go to the path where the users are located set the view to details and you will see when the last user folder was modified, that will tell you which user was the last logged in.
jcimarronCommented:
gavin_d--
Browsing History can be seen using
http://www.nirsoft.net/utils/browsing_history_view.html

When logons occurred can be seen from Event Viewer

I do not know what audits you want and may not know how to access.
MPCP-StewartCommented:
It looks like the IE history and recent user login was answered.

Your best bet for finding an audit trail on files is to pick a folder (or even the entire drive) and sort by last modified documents.

(I'm assuming you cannot boot to Windows and this is all done in File Explorer on the mounted drive)

To be even more specific and get detailed info:

1. Open File Explorer and right-click the column title in the Details view (where the column labels Name, Size, Type, and Date Modified appear).

2. Select “Date created” from the context menu.

3. Click “More” and from the list of options check the box for “Date accessed” (among other options) and click OK.

4. Now sort them in descending order to see all the recently changed files.

It's also possible to modify the Windows search in case you don't want to do that.

When you begin a search using the search bar,  click in the search box and type datemodified:. A new window named “Select a date or date range” will appear.

Those are your best bets for audit-trailing data through file explorer.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gavin_dAuthor Commented:
Fantastic response and exactly the information I was looking for
jcimarronCommented:
gavin_d--
Glad to have helped.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Storage Hardware

From novice to tech pro — start learning today.