The majority of users does not really know about this. Most think for instance that deleting files will delete them completely, which is not the case. Here is a collection of five different locations and ways to find out more about a previous computer user. You can use the information on your own computer, to see if a third party could grab those information from yours as well.

1. Display Deleted Files

Deleted files are not directly deleted by the operating system. Even if you delete them directly or make sure to delete the trashcan as well. Why? Because it is faster to simply delete information about the file, than the file itself. While you won’t see the file anymore in your OS, it may still be fully accessible on the hard drive of the computer. Someone with the right set of tools could recover the files to get access to what you have been deleting.

Tools for the job:

• Disk Digger
• Glary Undelete
• Panda Recovery
• Recuva
• Undelete Plus

How to protect yourself:

Wipe the free disk space regularly. This overwrites the free space on the hard drive which makes standard file recovery impossible.

• Blank and Secure
• CCleaner
• Eraser

2. The Web Browser History

Web browsers are configured to record the web browsing history. This is done in databases in the program directory most of the time as well a cache that contains pages, images, cookies and other elements of visited websites. It is quite easy to use the cached information to see what sites a user has been visiting in the past and what has been downloaded to the computer.

Tools for the job

• Built-in web browser tools to access the history and cache
• The standard system file browser, e.g. Windows Explorer
• Firefox Cache Viewer
• Google Chrome Cache View
• Video Cache View

How to protect yourself:

You can configure web browsers to delete the cache regularly, for instance at every exit or every five days. Here is how you would do that in Firefox. Open the Firefox web browser and click on Firefox > Options, or select Tools > Options from the menu. Switch to the Privacy tab

You can either configure Firefox to never remember the browsing history, or use custom settings for the history. This way you could disable the browsing and download history, but keep cookies for your logins.

3. Recent Items

Another area where you might get a lot of information about computer usage is the recent items list. The operating system and multiple third party tools keep tabs on programs or files that have been opened recently. If you have not done anything with the OS or application yet, you may find previously opened files and programs by the system’s last user.

Tools for the job

You can access the information right in the application or the operating system. For Windows 7, you could for instance click on the start button and select Recent Items from the Start menu, or right-click an item in the taskbar to see its jumplist entries.

How to protect yourself:

You need to disable recent items either in a control panel of the operating system or in the third party application. For Windows 7, you would simply right-click the start orb and select Properties from the context menu.

Locate Store and display recently opened items in the Start menu and the taskbar to disable that feature.

Closing Words

The three method above are common options to analyze a computer system. Have other suggestions? Let us know in the comments.

The recent items that are displayed can be a security and privacy risk. Even more so as there are no obvious means to delete and manage them effectively. The only option that a user has is to right-click specific recent items in the jumplist for options to delete that item.

There is no option to delete all items or to exclude items from being displayed in the jumplist.

What most Windows 7 users do not know is that Microsoft is storing the recent items list in a super-hidden directory that cannot be accessed directly in Windows Explorer. One of the options to access that directory is to copy and paste the following path into the Windows Explorer address bar.

%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations

This will display a list of encoded file. Each file contains the information of a specific jumplist. It is however not easy to link those files to a jumplist. The only viable way to do that is to open the items in that folder in a text editor and search for recent items that are in the jumplist currently.

An easier way is to delete all files in the directory which will remove all recent items in every jumplist. This process can be automated with the command

del %appdata%\microsoft\windows\recent\automaticdestinations\*

Experienced users can add this to the Windows Task Scheduler to run the command on every shutdown of the system. (via How To Clear Recent Jumplist Items at Windows 7 News)

The information are stored in the registry using a simple ROT-13 encryption. Windows XP saves the full path and name of the program, last access and the number of total executions. UserAssist is a nice little tool that decrypts the information and displays them it its main window. You can clear single entries by right-clicking and selecting clear. If you do have many entries in that list you might want to clear them all by clicking on commands, clear them all.

This does not disable the logging, it simply clears the current state. Windows XP will continue to log all activity unless you disable the whole process by clicking on commands, logging disabled. This will take effect once you restart, logoff and on again or kill the explorer.exe task in the task manager.

The manual way to disable logging would be to open your registry and navigate to the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\Settings\NoLog

and set the value of that key to 1.

Windows stores the encrypted information in the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Please note that you should not disable or clear the feature if you want to work with the recent items in your start menu.