How to Analyze a Computer's History
A computer used by more than one person in a household or business can impose risks, particularly viruses or a child looking up something he shouldn't. These threats leave a history on a computer that can easily be analyzed by you. The steps involved can be done through your operating system without the need for additional software. If your computer uses Windows XP software, follow these steps.
Other People Are Reading
Instructions
-
Using Windows Auditor
-
1
Start an administrator account on Windows XP by going to Start, Control Panel, Pick a Category and clicking on "User Account." Click "Create a New Account" under the "Pick a Task" menu. On the "Name the New Account" window, put in your first or full name. Create a password by going back in to "User Account" and choosing "Create a Password" under the "What Do You Want to Change" menu.
-
2
Sign on as an Administrator. Do this by clicking Start, Log Off and then Switch User. On the welcome screen, press Control, Alt and Delete at the same time, then watch for the sign-in box for your name and password.
-
-
3
Set up a System Restore point by going into your Start menu, calling up All Programs, Accessories and System Tools. In System Tools, find System Restore and click there. The System Restore Wizard opens and gives you the option of creating your restore point. Click that option and give a description of it in the little description box. Press "Create" in the Wizard box.
-
4
Go into your Start menu again to disable simple file-sharing so others can't access your files. Click on Start, My Computer, Tools and Folder Options. Click on View and then press Advanced Settings to access the simple file-sharing command. Click on the little white box next to "Use simple file sharing," and make sure the green check mark has been removed.
-
5
Open the Group Policy window by pressing Start, then Run, and typing in "gpedit.msc."
-
6
Look for Computer Configuration in the Group Policy window, click there, then Windows Settings, then Security Settings and then Local Policies. Audit Policy will be under Local Policies. Click on it to access.
-
7
Watch for the Audit Object Access icon, and double-click on that. Click on Properties, and make sure you place a check mark in the little white box next to the title of "Success." Press OK to complete activating the Windows Auditor.
-
8
Choose a file you want to keep track of in the coming weeks or months. Right-click on that file, and choose Properties. Find Security, click on that, press Advanced, and find the Auditing icon. Press Add next to it.
-
9
Look for the "Enter the Object Name to Select" box, and enter specific names or just "Everyone" so you can keep track of all who use your computer. Click on the Check Names icon so Windows can check if all the names are valid. Press OK to complete the process.
-
10
Wait for multiple Auditory Entry boxes to appear next to each file you want to track. Select which ones you want, and press OK. You're now ready to keep track of your computer's history if you suspect your security has been threatened.
Accessing Event Logs
-
11
Try this simpler computer history tool. Click on the Start icon at the bottom left of your computer on Windows. Choose Control Panel and Administrative Tools.
-
12
Look over the window that comes up showing various icons as options. Double-click on the little icon showing two exclamation points and a question mark with the title of Event Viewer.
-
13
Read through the different categories that represent certain functions on your computer. Click on any of them, and you'll be given a list of events that occurred under each category. Categories can include things that happen on Internet Explorer, Applications or Security.
-
14
Right-click onto any of the events listed to access the properties of when the event happened or when it was potentially altered. Know, though, that right-clicking on the event assumes another event and will record the current time in place of the previous time. This could ruin evidence of when something occurred if evidence needs to be preserved.
-
1
Tips & Warnings
One of the simplest methods for checking your computer's history is to click on View at the top menu on Internet Explorer. Select Explorer Bars in the View menu, then the sub-menu of History. This calls up a box showing all the websites visited recently on your computer. Note, however, that all that history can be deleted quickly by any user using Internet Explorer's Delete Browsing History feature in the Tools menu.
