LastActivityView: See Recent User Activity and Events on Windows

LastActivityView (also written Last Activity View) is a free, portable NirSoft utility for Windows that shows a single, time-sorted log of what happened on a PC: programs run, files and folders opened, software installed, logons and logoffs, startups, shutdowns, sleep, crashes and network connections. It reads this from data Windows already keeps (Registry, Event Log, Prefetch, Recent folder) and exports it to CSV, HTML, XML or text.

This guide covers what LastActivityView records and where each entry comes from, how to download and use it, its command-line export options, its accuracy limits, and how to remove the traces it reveals.

What does LastActivityView show?

LastActivityView shows a chronological list of user actions and system events, one row per action, with the action time, a description, the file name or path, extra information and the data source. NirSoft describes it as a tool that "displays a log of actions made by the user and events occurred on this computer." The actions it detects include:

• Run .EXE file, Task Run (scheduled tasks) and Software Installation
• Open file or folder, View Folder in Explorer, and Select file in open/save dialog-box
• User Logon and User Logoff
• System Started, System Shutdown, Sleep and Resumed from sleep
• Windows Installer Started and Ended, Restore Point Created
• Network Connected and Disconnected, Wireless Network Connected and Disconnected
• Software Crash, Software stopped responding (hang) and Blue Screen

The program does not log anything itself and installs no background service. It only collects what Windows has already stored, so what you see depends on how much history the system still holds.

Where does LastActivityView get its data?

LastActivityView builds its log from six Windows sources, and knowing them tells you why an entry exists and how long it lasts. The Data Source column (added in version 1.35) shows the origin of each row.

The tool also reads the Minidump folder (C:\Windows\Minidump) for Blue Screen entries and, if you enable Options > Read Archive Log Files, archived event logs (Archive-*.evtx). On Windows 8 and later, Prefetch files store up to 8 run times per program, and LastActivityView lists each of them (version 1.11 and later).

How to download and use LastActivityView

LastActivityView needs no installation: download the ZIP from NirSoft, extract it and run LastActivityView.exe. It works on Windows 2000 up to Windows 11, and NirSoft offers separate 32-bit and 64-bit downloads.

1. Open the official LastActivityView page on nirsoft.net and download the 32-bit or 64-bit ZIP that matches your Windows.
2. Extract the archive to any folder, for example on a USB stick if you want to run it on several PCs.
3. Run LastActivityView.exe. The list is sorted by action time by default.
4. Click a column header, such as Description or More Information, to sort by that column instead.
5. Press Ctrl+Q (View > Quick Filter) and type a word, such as a program or folder name, to show only matching rows.
6. Open Advanced Options to show only activity from the last few seconds, minutes, hours or days.
7. Select rows and use File > Save Selected Items, or copy them to the clipboard and paste into Excel.

Saved reports can be text, tab-delimited, CSV, tabular text, HTML (horizontal or vertical) or XML, in ANSI, UTF-8 or UTF-16 encoding (Options menu). Options > Show Milliseconds In Time adds finer timestamps for timeline work.

LastActivityView command-line options

LastActivityView can export its full log from the command line without opening the window, which makes it useful in scripts and support toolkits. Each switch saves all detected actions to the file you name:

Example: LastActivityView.exe /scomma C:\Reports\activity.csv writes the whole log to a CSV file you can open in a spreadsheet or diff against a later export. You can pair a scheduled export with other built-in tools, such as the Windows shutdown command, in maintenance scripts.

How accurate is LastActivityView?

LastActivityView is a good first look, but it is not a complete or court-grade audit log. NirSoft lists three limits, and they matter when you draw conclusions from the timeline:

• Coverage varies by system: if a source is empty, cleared or disabled (for example, Prefetch turned off), those actions do not appear.
• Some Registry-based times are estimates, because they come from the last modified time of a key, not from a recorded event.
• Some actions keep only the latest entry: the open/save dialog list stores one item per file extension, so only the most recent file of each type shows.

Treat a missing entry as "no record," not "did not happen." To confirm an important event, check it in Event Viewer or compare with a second source, such as the Restore Point list (see how to manage System Restore from the command line). If you find an unknown program in the Run .EXE list, check its file and verify its digital signature before deciding whether it is malware.

How to delete the activity LastActivityView reveals

LastActivityView cannot delete anything; to remove entries you clear the Windows source behind them, and NirSoft warns that some of this data is essential and deleting it is at your own risk. Back up or create a restore point first.

• Event Log entries: in Event Viewer (Control Panel > Administrative Tools > Event Viewer), clear the log that holds them. Single events cannot be removed.
• Run .EXE file entries: delete the matching .pf files in C:\Windows\Prefetch.
• Open/save dialog entries: delete the OpenSaveMRU or OpenSavePidlMRU values; Windows then forgets the last used files and folders.
• Open file or folder entries: delete the shortcuts in the Recent folder (Win+R, type shell:recent).
• View Folder in Explorer entries: delete the Shell Bags subkeys; Explorer forgets per-folder view settings.
• Software Installation entries: leave the Uninstall keys alone, since deleting them stops you from uninstalling that program normally.

For repeatable cleanup of many of these traces, a reviewed script collection such as privacy.sexy is safer than hand-editing the Registry.

FAQ

Related: manage Windows accounts with net user, display all cached DNS entries on Windows