Hello,
I have to examine when and if a Windows-PC was online / had connectifity at a special time. Have you any advice how to find this out?
Kind regards
A.
It depends…what OS, and which version?
If Windows, particular Vista+, I'd use a timeline, including Registry and Windows Event Log data in it. There is a lot of really good info that can help you answer this question.
I'd use a timeline, including Registry and Windows Event Log data in it.
and antivirus log, too.
I'd use a timeline, including Registry and Windows Event Log data in it.
and antivirus log, too.
and upstream device logs too.
Timeline analysis can bite you - there will be events that have a timestamp during the time the device was powered off. So be careful just assuming that a timestamp means the computer was on.
Windows event logs would be your best source. From vista onwards there are specific events for startup and shutdown.
Windows event logs would be your best source. From vista onwards there are specific events for startup and shutdown.
And what were there BEFORE Vista? ? roll
jaclaz