Notifications
Clear all
Topic starter
02/06/2007 6:18 am
How does this tools work?
How are the results determined? Event logs?
-ss
03/06/2007 3:00 am
Hi secret_squirrel,
the answer is simple. Yes, it uses the eventlogs. You can try it on your own pc. Delete the system event logfile and PCTime is empty. On the other hand, in most corporate enviroments you have all kind of restrictions for users. If the security is ok, they can't delete the logfiles. You can use PCTime to plan your investigation on a user workstation. It gives you a nice view when a user is absent.
For your investigation it is just a little bit of information. You should use it in combination with the server or domain controller logfiles and the access control registration of a building. It just depends on what you have to investigate.