Find out what happened recently on your Windows PC
If you want to find out what happened recently on your Windows PC, say which programs or files were opened or saved, or which USB devices were connected to it, then you can either dig deep into the Windows Registry and Event log, or use specialized software which makes the process more comfortable.
Nirsoft created several programs in the past that assist you in finding out more about the various actions and events on a machine running Windows.
This guide looks at six programs by Nirsoft that you can use for that purpose. All programs are portable and compatible with all recent versions of Windows including Windows 10.
The programs
- ExecutedProgramsList - The application lists executable files opened in the past under the user account.
- LastActivityView - Lists events and activities on the system such as program executions, file and folder activity or software installations.
- OpenSaveFilesView - The program lists all open and save actions of the user account it is run under.
- TurnedOnTimesView - The software analyzes the Windows event log for power state changes and lists them in its interface.
- USBDeview - The program lists all connected as well as previously connected USB devices.
- WiFiHistoryView - The application
ExecutedProgramsList
ExecutedProgramsList displays executable files that were opened in the past on the computer system. It displays file names and paths, last modification and creations dates, and the last time they were executed on the machine.
A click on a header sorts the data accordingly, for instance by execution date or by path.
As you can see on the screenshot above, data can date back quite a while.
LastActivityView
LastActivityView is a portable program that displays the most recent actions and events that occurred on the computer during the session and in the past.
The data is sorted by date and time, and includes information such as the type of action or event, the filename and the full path of the file.
It provides you with information about the program's that were run on the system, open and save file dialogs, file and folder activity in Windows Explorer, software installations, crashes, and more.
OpenSaveFilesView
OpenSaveFilesView lists files that were previously opened or saved using standard open/save dialogs on the Windows computer.
The program lists files by name and path, extension, the time they were last opened, modified or created, their size, and attributes.
As is the case with all Nirsoft applications, you can click on a column header to sort the data accordingly, for instance by last open or creation time.
TurnedOnTimesView
TurnedOnTimesView scans the Windows event log for power state changes and displays all it finds in its interface.
It lists the startup and shutdown time, duration of use, shutdown type (power off, reboot), process, code and if available, shutdown reason as well.
It tells you, basically, when and for how long the computer was being used.
USBDeview
USBDeview lists all USB devices that have been or are connected to the computer. Each device is listed with its name, description and device type, whether it is currently connected, creation date, serial number and many, many other information you may find useful.
Using it you can check if unauthorized USB devices were connected to the PC in the past, an external hard drive for instance.
The data can be sorted with a click on a column header, for instance by last plug in / unplug date.
WiFiHistoryView
WifiHistoryView displays the wireless network connection history of the computer system. It lists the date and time of each connection, the network adapter used, the local MAC address, profile name, SSID of the wireless network and other information.
The information alone can be useful to troubleshoot connection issues as it lists connection failures and disconnection events among other things.
Closing Words
The six programs are handy even if you don't require them regularly. Since they are portable, they can be run from any location, for instance a Flash Drive or other removable media, and run on any system running Windows.
Where is my comment?
I accidently ran the clean-my-traces.cmd script (was trying to view it, but it ran instead) and now File Explorer is unable to store folder options, which is really annoying.
Any help?
Ran the clean-my-traces.cmd script above and now I am unable to save any settings for any folder within File Explorer. Methinks it may have trashed too much of the registry and now prevented any folder settings from being save at all.
Any help John Krazinski restoring these?
Thanks.
And maybe I could use it with the information gathering program Martin reported on back in June 20, 2014 on ghacks.net that is called ” Collect information about your PC usage with WhatPulse” http://www.whatpulse.org/
Martin verdict about the program back than was:
“WhatPulse offers interesting information about how you are using a computer. While that is great in itself, it may help you optimize your workflow further or keep track of how you spend your time when you are working on the computer.
If you keep the online feature enabled, you can compare your activities to that of your friends or the application’s worldwide audience.”
Request to Martin:
Next thing is that I have a question actually its more a request to Martin. Every time you are writing a article Martin would you be so kind to maybe in the header for filing and searching back to give every article (more than the
software classification like your doing right now) a classification name:
Like this article maybe could be called: software – Actions & events?
This because I often want to compare and also read up on older articles when I want to remember things.
And with every article I am always quiet a long time busy to think about how to classified it.
Maybe not only me is thinking that that is a good idea?
Paulus, we had that in the past in the form of tags, but in the wake of Google updates, removed them.
LastActivityView is my favorite one, nice utility.
Martin, is there a way to erase those entries to improve privacy?
Look at the comment by Dexter on this page: https://www.ghacks.net/2014/06/09/remove-old-shellbag-entries-windows-privacy/
Or use Privazer.
CCcleaner is sub-par compared to it.
Thanks for this article Martin!
And this one is for disabling Prefetch. http://pastie.org/10771393
And if you use HDD and want to keep using prefetching to get some performance my tip is (in the batch) store it in R:\temp. You keep privacy after reboot and is faster than store in HDD. (http://www.ltr-data.se/opencode.html)
(anybody seem pants around? :) the cia is after him LMAO )
Here you go: http://pastie.org/10771332
Name it clean-my-traces.cmd
Thanks John, this will surely come in handy.
@kopija
Hmm.. cool. I’ll write a script to cleanup those entries.
I’ll post it here when done.
@John Krazinski, It tells you where each program gathers it’s data on the relevant page for the utility.
I tried his script but the entries are hidden somewhere else. they still appear on nirsoft apps.
I “wrote” this one .reg file to delete all entries but they are still hidden somewhere.
http://pastie.org/10770688
CCleaner (cannot remember with or without CCEnhancer) takes care of some of them, not sure if all.
Thanks guys!
I miss the days of the small, quick, one-trick pony apps. The huge do-it-all things with the big, clunky interfaces, that hog the screen and demand attention are an irritation. I love NirSofer’s little apps. They just pop up and show me what I want to know. I hope they never change, there’s loads and loads of the other stuff out there for those of you who want all-in-ones.
@E, @ad
There’s room for a middle ground. Boy the IT industry is so ridiculously binary. Things don’t have to be piecemeal or gargantuan. WSCC is no better than having all the utilities separate. They’re two extremes.
Am application can be a home for user choice. Whether it be during installation, through addons, simple toggling of features in a preferences context or even opening individual utilities in distinct tabs within the one interface … there’s a whole bunch of choices available to developers to address the need for applications to be more than simplistic utilities, but less than bloatware.
Whilst Nir Sofer is obviously a hero for producing hugely useful utilities, I feel it’s time move beyond his approach of Unix-style single-purpose utilities.
In effect his programs are usable lists of information stored but essentially obfuscated behind strangely unfriendly tools in Windows. Regedit, event viewer … these are interfaces only their authors could possibly love. For this reason a plethora of often masturbatory graphic designer oriented utility or middle ware is everywhere for Windows. These programs perform a handful of maintenance tasks supposedly in the name of performance or privacy but, as many suggest, can also be considered nothing more than snake oil.
It’s time for something much better. NirSoftware exposes the atrociously pathetic nature of the built in Windows diagnostic tools by raising the presentation bar beyond Microsoft’s messy, clunky and limited UI choices. However lists of data focusing on X, Y or Z areas of interest are very piecemeal. In one sense it feels powerful to finally have clean and simple access to this info that normally seems hidden. But that’s all Nir’s programs do: raise the bar above an atrociously bad baseline and then often still leave users in the cold, none the wiser.
Is Nir’s code open source? I don’t think it is. If Nir opened his code there could be scope for other developers to use it as a springboard to creating an b application that would truly give users a more integrated tool with which they could answer the sort of use case captured in the theme of this article.
Wait, we must hear from Pants before putting our comments.
Pants, you there dude?
Now nirsoft is watching us man. We gotta do something. It is the government man.
:)
When looking at the information that’s available from programs like these it sort of pours cold water on claims that it’s just telemetry with Windows 10 and people shouldn’t be concerned.
@E:
Because your mileage always varies from others. Not everyone prefers one super mighty, super big tool for just 2…3 functions in it.
Use WSCC (Jojos comment) to keep them together and up to date (and to learn how f*cking big such a super tool would be. 202 tools from Nirsoft alone, and still counting…)
Best way to access Nirsoft many programs (or Sysinternals programs) and keep them updated is to use launcher WSCC.
http://www.kls-soft.com/wscc/downloads.php
First program link seems in error, perhaps it should be:
http://www.nirsoft.net/utils/executed_programs_list.html
Thanks George, corrected.
Why the heck would you not just combine all these into one program, instead of having all these little things. God that’s dumb and annoying.
Imagine if CCleaner was 50 little programs and if you wanted to clean out Firefox’s cookies you had to boot up one for that, want to do Windows Temp files next? Gotta boot up another.
Nir Sofer deserves a medal.
I think there was also last accessed file and folder list from Nirsoft; what’s interesting that these tools are working despite of system being cleaned by one of these programs – either data regarding these activities is stored in really secure spot or all these cleaners are lying while promising system cleanup. Nevertheless, these programs are both useful and dangerous.
These little tools tell a lot. A LOT, like your RAZER DEATHADDER :^)
hahah .. dickbutt :p …. ;o)