Questions concernin...
 
Notifications
Clear all

Questions concerning User Login / Document Access

2 Posts
2 Users
0 Likes
313 Views
(@pfkoss)
Posts: 18
Active Member
Topic starter
 

I'm working a case in which it is important to identify documents on a personal system (laptop XPHome) and the userid that was working on the document and when. I've extracted all of the documents and noted the folder locations, and MAC dates/times. I examined the EVT files but nothing of any real user there (XP HOME). I figure that there is liitle more that I can do to identify amount of work per user and the dates and times of that usage (with respect to work on documents.)

Am I missing anything. Is there anything in the registry that would show login times by user id

Thanks in advance

 
Posted : 21/12/2005 12:45 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

There are Registry locations where you can look, as well as MRU listings for Word (and other Office products).

Also, have you considered digging into the metadata associated with the documents (Word??) themselves?

Harlan

 
Posted : 21/12/2005 1:13 am
Share: