Get history of file operations in Windows?

Question

Is there a way to get a history of file operations in Windodws, like which folders were moved where, last renamed file, what was deleted, etc.?

score 3 · Answer 1 · edited Sep 20 '11 at 05:29

3

Process Monitor by SysInternals can monitor and log all file, registry and network operations.

procmon.exe

You have to be careful though. In the screenshot above, even though it says CreateFile all access is read-only (libraries (DLLs) being loaded).

edited Sep 20 '11 at 05:29

Gareth

answered Jun 08 '10 at 21:48

grawity

score 2 · Answer 2 · edited Sep 20 '11 at 05:29

There is no such log by default.

On a Windows NT system, an administrator can enable auditing of file operations:

Auditing settings for a directory

However:

For this to work, "Audit object access" must be enabled in secpol.msc:

The moment you turn it on, you will get flooded by miscellaneous object access logs.
Audit logs of the entire filesystem will fill up the Security log really fast. I'm not going to talk about performance hits.

2 Answers2