I'm working a case in which it is important to identify documents on a personal system (laptop XPHome) and the userid that was working on the document and when. I've extracted all of the documents and noted the folder locations, and MAC dates/times. I examined the EVT files but nothing of any real user there (XP HOME). I figure that there is liitle more that I can do to identify amount of work per user and the dates and times of that usage (with respect to work on documents.)
Am I missing anything. Is there anything in the registry that would show login times by user id
Thanks in advance
There are Registry locations where you can look, as well as MRU listings for Word (and other Office products).
Also, have you considered digging into the metadata associated with the documents (Word??) themselves?
Harlan