If you want to find out what happened recently on your Windows PC, say which programs or files were opened or saved, or which USB devices were connected to it, then you can either dig deep into the Windows Registry and Event log, or use specialized software which makes the process more comfortable.
Nirsoft created several programs in the past that assist you in finding out more about the various actions and events on a machine running Windows.
This guide looks at six programs by Nirsoft that you can use for that purpose. All programs are portable and compatible with all recent versions of Windows including Windows 10.
ExecutedProgramsList displays executable files that were opened in the past on the computer system. It displays file names and paths, last modification and creations dates, and the last time they were executed on the machine.
A click on a header sorts the data accordingly, for instance by execution date or by path.
As you can see on the screenshot above, data can date back quite a while.
LastActivityView is a portable program that displays the most recent actions and events that occurred on the computer during the session and in the past.
The data is sorted by date and time, and includes information such as the type of action or event, the filename and the full path of the file.
It provides you with information about the program's that were run on the system, open and save file dialogs, file and folder activity in Windows Explorer, software installations, crashes, and more.
OpenSaveFilesView lists files that were previously opened or saved using standard open/save dialogs on the Windows computer.
The program lists files by name and path, extension, the time they were last opened, modified or created, their size, and attributes.
As is the case with all Nirsoft applications, you can click on a column header to sort the data accordingly, for instance by last open or creation time.
TurnedOnTimesView scans the Windows event log for power state changes and displays all it finds in its interface.
It lists the startup and shutdown time, duration of use, shutdown type (power off, reboot), process, code and if available, shutdown reason as well.
It tells you, basically, when and for how long the computer was being used.
USBDeview lists all USB devices that have been or are connected to the computer. Each device is listed with its name, description and device type, whether it is currently connected, creation date, serial number and many, many other information you may find useful.
Using it you can check if unauthorized USB devices were connected to the PC in the past, an external hard drive for instance.
The data can be sorted with a click on a column header, for instance by last plug in / unplug date.
WifiHistoryView displays the wireless network connection history of the computer system. It lists the date and time of each connection, the network adapter used, the local MAC address, profile name, SSID of the wireless network and other information.
The information alone can be useful to troubleshoot connection issues as it lists connection failures and disconnection events among other things.
The six programs are handy even if you don't require them regularly. Since they are portable, they can be run from any location, for instance a Flash Drive or other removable media, and run on any system running Windows.
Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.
We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats or subscription fees.
If you like our content, and would like to help, please consider making a contribution:
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.