You returned to your workplace and feel that something is wrong... The monitor is at an unusual angle, there are some crumbs on the keyboard and table. Do you suspect that someone was using your computer while you were away? Well, it's quite possible. However, you cannot prove this. Or is there still a way? In this article I will tell you how this can be proven and how to catch an unknown person red-handed.
In fact, no activity on a computer goes unnoticed. Of course, if your uninvited guest is not a professional hacker. Do you have any such friends? Then let's begin. Let's start with the simplest and gradually delve into the depths of the operating system.
Windows log
With this system application, you can determine what actions were performed on your computer in the last minutes, hours, or days. Need to:
- open the search bar in the Start menu or control panel, depending on the OS version;
- enter the query “View event logs”;
- find the required system application in the results, click on it, wait for a window with a list of events to appear;
- select “Windows Logs”;
- find the required log, double-click on it and start viewing information about the latest actions on your PC.
Can I use special software to view activities on a PC?
Programs that make it easier to get acquainted with the history of views and actions on a computer and laptop are not only possible, but also necessary. The main thing is to download them from reliable resources.
One of the best free applications that can help you find out what software has been launched on your machine over the past few days is ExecuteProgramsList. It doesn't even need to be installed; Just download and run - all information about open processes will be displayed in the main window.
And by double-clicking on any of the list items, the user will be able to obtain detailed information about the event: from which directory the program was launched, at what time, under what account, and so on.
Recent Documents
To find out which files were last opened, you need to open the “Recent Documents” section located in the system menu. For Windows 7 it is disabled by default, but if necessary, it can be enabled:
- open the properties of the Start button in the context menu;
- go to the “Start Menu” page;
- click “Configure”;
- Check the box next to “Recent Documents”.
- Click “Ok” to make changes.
For Windows 8, recent files are not available in the Start menu. To view them, you need to use the “Win” + “R” key combination. In the window that opens, you need to write “recend” and then press the enter key. A folder with recent files will appear.
Another way is to open drive C and set the files to be sorted by date modified.
Find out what programs and applications were launched
There are quite a lot of categories, and most of them are of no use to the average user. Most often, a simple PC user is interested in what applications were launched. It's quite easy to find out. Relevant information is contained in the category “Windows Logs” - “Applications”.
If you go there, you can see the history on the computer of what was launched. For example, in the image above you can see that the Skype update service was launched. You can also find out at what time this happened and what the result of this action was. After these simple steps, you can view the history on your computer.
If, in turn, you want to find out what applications were installed, you can look at the “Installation” section. It displays information about the installation of not only third-party programs, but also services built into the system.
Browser history
To find out which websites have been visited recently:
- open a web browser;
- simultaneously press “ctrl” + “H”;
- set the period for which you want to view visited pages.
more details Choose Avast! 4.8 Home Edition
Another way to view your browser history is to enter the browser name://history/ in the address bar, for example, chrome://history/ or opera://history/.
You can also open your browsing history through the web browser menu.
Running programs
The “Open Date” field in the file properties allows you to find out which utilities and applications were launched in recent days. You need to open drive C (or another one on which the OS is installed), go to the “Program Files” folder, and then click on the “Search” line at the top right, enter “*exe” and press “Enter”. All possible executable files located in this folder will appear. You must select the “Table” view mode, click on the header of an arbitrary column and in the “Details” field, check the box next to the “Date of access” line. To save the changes, click “Ok” and then sort by the column that appears. For a 64-bit OS, you need to repeat the same steps for the “Program Files (x86)” folder. In addition, you need to perform the same steps for folders with games and installed software, if it is located somewhere else.
Checking what you searched for on Google
see also
- How to get rid of Google surveillance on the Internet and beyond
Google very carefully collects the entire history of your actions in all its services and applications. And you, as the owner of this personal data, can check your entire history at any time. Actually, how to delete it, or even prevent Google from saving all this data.
Among all the information stored in Google, you can find both search queries and visited sites, as well as applications opened on phones.
If someone used a computer in your absence and used Google services under your account, then you can easily see what exactly was viewed, where this person went, what search queries they entered, and much more.
You can find and study all this information in the special “Tracking Actions” section.
Basket
If you need information about which files were deleted during previous actions, chances are they are in the Recycle Bin. It may not have been cleared and it will be possible to recover lost data.
To find out which files were most recently deleted from your computer, you need to open the Recycle Bin and sort the files and folders by date. To do this, just click on the name of the column “Date of deletion”, after which the data will be arranged in the order of interest. All that remains is to find the required time period and view what was deleted.
more details How to change your computer's IP address
If you need to restore a file, just click on it and select “Restore” in the context menu.
How to see the latest activity on this computer
Let's look at simple ways to find out the actions of the previous user of the device:
- To begin, open the contents of the Windows Recycle Bin. Its contents can be very useful.
- Pay attention to the first files in this folder. If you didn't delete them yourself, someone else might have. Deleted files contain the time they were moved to the Recycle Bin.
- To see the deletion date, right-click on the file and click “Properties”. The “Deleted” line will contain the date and time it was moved to the trash.
Time to move file to trash
Now let's move on to another method. All browsers have default settings such that any file you download from the Internet ends up in the “Downloads” folder. It is located on the system disk.
If you don’t go into details, you can find it quite quickly:
- Press WIN+E to open Windows Explorer (regardless of version).
- Pay attention to the side column with the “tree” of system folders. There will be the necessary “Downloads” folder with the latest files.
- Open the folder and view its contents.
- Select one of the RMB files and click “Properties”.
- Pay attention to the block below, where the file modification time, opening time and creation time will be located.
The time when a file is created is when it is downloaded from the network. In this way, you can also find out a lot about the past activity of unauthorized persons on your computer. You can change the display type of “Downloads” files and see these dates for all files in it at once. To do this, you need to select the arrow at the top right that expands the folder settings panel, and select the “Details Area” item on the left. After this, another area will be displayed in the window, which will contain the complete information of the selected folder.
This is interesting: How to clear history in Opera.
Power Spy
A third-party application that is easy to use and understandable even to an inexperienced person. Supported by most versions of Windows OS, it is registered in autorun and starts working when the computer boots. The program saves data about everything that happens on the computer, and then allows you to view a report of all the actions performed on the device. If there is such a need, the data can be saved to a file in one of the convenient formats.
All necessary information about recent events on the computer will be reflected in the Event Log. To view it, you need to select and open the section of interest. For example, if the user needs information about all open windows, he needs to launch the utility and click on the “Windows opened” icon. The necessary information will appear on the screen.
In the same way, you can view other information; there are a large number of similar sections in the program menu.
Activity history in Windows 10
Keeping Windows 10 privacy in mind, Microsoft suggests you manage your activity history and limit your Windows 10 PC to tracking. Before we begin, there are a few things you should know about the timeline and activity history:
- It collects activities from the PC you are using.
- It can sync your activities from this computer to the cloud.
- You can access this history when you switch your computer
This is all linked to the Microsoft account you sign up for on your PC.
NeoCpy
An excellent utility that analyzes what is happening on the computer. It works hidden, its presence in the OS is invisible, starting from the moment of installation. During installation, the user can assign the program's operating mode: open or hidden, in which the application's program files and shortcuts are hidden.
The application has extensive capabilities and is suitable for both home and office use.
To see what actions were most recently performed in Windows, you need to:
- run the utility;
- select the “Reports” tab;
- click “Report by category”;
- establish the period for which data is needed;
- Click "Download".
The user will receive detailed information about what events occurred on the PC during a specified time period.
download Crypto Monitor for mining
[Bonus] Set a trap for the unknown
Now, having all the evidence in hand, we can guess who is using our computer and talk to him. But it's even better to catch him red-handed! To do this, you can use the standard Windows Task Scheduler.
When creating a task, specify the event (trigger) “Login to Windows”.
Now think about what you would like to do when someone logs into the computer without you. The simplest option is to send a letter to yourself, for example, on a communicator.
Although personally I would prefer the “Run a program” option. And then I would download some kind of prank program that flips the screen or causes it to “crumble.” Imagine the face of the unknown at this moment!
The Windows 10 Timeline feature keeps track of everything you do on your PC, i.e. the apps you open, the files you access, etc. All the data is stored on your Windows 10 PC and Microsoft account. This makes it easy to access them and start working on the left. This is known as Action History .
