hello all ..
some one put a usb stick in my computer for 1 mint and he print some .docx is there anyway to to know what is he printed !! and know the file name and details … etc
Possibly, yes.
What is the OS/version you're running?
Was it a network printer?
The .docx files may have been opened prior to printing…do you know the user account used to do this? If it was your account, do you know approx what date/time this may have occurred?
It really wouldn't be too hard to track this down.
Possibly, yes.
What is the OS/version you're running?
Was it a network printer?
The .docx files may have been opened prior to printing…do you know the user account used to do this? If it was your account, do you know approx what date/time this may have occurred?
It really wouldn't be too hard to track this down.
os windows 7 32bit
printer normal printer ( hp ) it's connected by usb to my pc !
i dont know if the docx file is opened or what ? how to know that !
and he used my user account
There are Registry entries in your NTUSER.DAT hive file, as well as in JumpLists/Recents shortcuts that can tell you this…
There are Registry entries in your NTUSER.DAT hive file, .
more info please
There are keys within the NTUSER.DAT that record information about MSOffice documents accessed via the user account (the same is true for other applications and file types, as well). For example, the RecentDocs key will have subkeys for "doc", "docx", and even "docm", depending upon the extension of the file opened. Some of this information also has time stamps associated with it, so you can see when the action was taken.
I don't know that there will specifically be an entry to show that the documented was printed, but if the account was used to open/access the file, you'll likely see that.
Also, you can check the Recent shortcuts and jump lists for the user, as well as the OAlert.evtx Windows Event Log file for further indications of access to the file.
When exported properly, the time information registry keys have is LastAccess (i think), but the order of the recent document values should be in order.
Another thing that can be done is to look in %temp% for work copies of the document in question. If it was edited, there will be several of them.
…but any of this does not prove that anything was printed.
If you have logging set up properly, you can see the printing service (spooler) log the user, document name and on what port it was printed.