Tech Support Guy banner
  • Please post in our Community Feedback thread for help with the new forum software! If you are having trouble logging in, please Contact Us for assistance.
Status
Not open for further replies.
1 - 5 of 5 Posts

·
Registered
Joined
·
2 Posts
Discussion Starter · #1 ·
One of my company's executives just got back from a European vacation. When trying to sign on to his PC (WIN98SE) he had forgotten his password and could not get signed on. Certain that he had not forgotten the password, he convinced himself that someone had been into his office and had been snooping around on his PC. I have been charged with proving or disproving that the PC had been accessed during the vacation. The system scheduler was turned off a year ago so the SCHEDLOG.TXT file is of no help. Is there any way that I can determine if a PC was accessed during a given time frame or not? Any proof must be certain as a large ego is involved here.

Thanks in advance.
 

·
Registered
Joined
·
7,486 Posts
You might start in find files. Click the Date tab . You'll see that you can search for all files modified, created and/or accesses between any dates you enter. If you try that and something pops out, you'll have proof the computer was used.
 

·
Registered
Joined
·
2 Posts
Discussion Starter · #4 ·
Are you certain of this? If the create or modify date gets updated every time you sign in, then when the exec signed on to his computer for the first time, all of the tell tale files would get updated to today's date, thus covering any tracks. I'd like to find a log file of some sort that has the date and time of all sign ons. I'm more a UNIX guy than a PC guy so maybe I'm expecting too much from Windows.

Thanks again.
 

·
Registered
Joined
·
7,486 Posts
The key is to set the correct dates. I just did it and it works. Modified,created or last accessed.



EDIT: After you have performed the search, go to the toolbar to Edit>save search
The search will be saved and placed on the desktop.
 
1 - 5 of 5 Posts
Status
Not open for further replies.
Top