Hi. Can anyone suggest an approach (using EnCase preferably) for ascertaining the number of times a user has viewed a particular file?
Many thanks.
UserAssist keys…?
UserAssit keys are useful for looking at application use. You may get your answer from Windows Explorer history recovered from NetAnalysis which can show recorded file access.
You might be able to see how many days in the last 90 the user has viewed the doc by looking at MRUs in the restore points' registry files.
The caveat there is that depending on the application there will only be a limited number of MRUs kept, and even though the user may have viewed the document, it may have gotten pushed off the end of the list.
Not quite what you are asking for, but perhaps useful…
Hi. Can anyone suggest an approach (using EnCase preferably) for ascertaining the number of times a user has viewed a particular file?
For something that specific, there really isn't any way of doing that…at least, none that I'm aware of…
Harlan is right. You can't get there from here.
The only way I can think of that comes close to accomplishing what the OP asked for is, *if* we're talking about XP, parsing the ComDlg32 and RecentDocs keys (RegRipper/ripxp works great for this) for the currently available user hives as well as all of those "recorded" in the Restore Points.
This won't tell you how many times the user viewed the file, exactly, but it will give you some idea of the activity with resepect to the file being viewed.
To emphasize what Harlan is saying is that there is no point and click method. You would have to build a time line of recent document access from restore points and the current state plus meta data. It will still just be an approximation.
You might be able to work it out from the link files relating to the file in the restore points. In any case you will not get the answer in any easy and simple way.
It also rather depends on what sort of file it is, there might be different things to take into consideration.
H