Using the files in Windows system to see who has used our computer

Computers are more or less stored in their own privacy, even if these privacy is not important, but still do not want to be exposed under the eyes of others, so we generally do not want their own computer to be arbitrarily used by others. But there are some people who do not care about our feelings, random use of our computer, still think we do not see, this idea is a bit out of it! Because Windows systems are smart. As long as someone moves our computer, we can find the truth by looking at some of the records in the system.

So what do we record when someone moves our computer? The first is the boot time. Windows will detail the computer's boot situation, which can be accurate to seconds. Next is the record of various events, as long as the other people run the program after a little problem, Windows will record it in the system's event log. Then there are the documents that have been run, and which documents have been opened, at a glance in Windows.

Log SchedLgU.Txt files at boot time

Every time windows turns on, it records the timing of the system startup in a text file called SchedLgU.Txt, which is hidden in the Windows directory of C. From the moment the system is installed, it will record the time that you turn on each boot. We go to the Windows directory to open this file, at the end of the file you can see the following words:

The Task Scheduler service

Started on 2011-3-30 22:06:55

The end is the last boot time record, visible last boot time for March 30, 2011 22:06:55. If you're not booting at this point in time, it means your computer has been moved.

Calling Windows Event Viewer

Windows has a powerful logging feature that logs can be viewed through Event Viewer, which is divided into "application", "Security", and "system" three pieces of content, as long as someone moves your computer, in general there will be some content recorded.

Open Control Panel → performance and maintenance → administrative tools → Event Viewer, we first switch to the "Application" column.

Call Event Viewer in Control Panel

As an example of the first-ranked event, this shows the startup of the SecurityCenter program in Windows, indicating that when Windows started, the Security Center was started, and the process was logged.

Every time you start your computer, SecurityCenter records the start time

So as long as someone drives a computer while you're away, it's hard to think about leaving traces here.

View "My Recent Documents"

All two of these methods only know if someone has moved your computer, but there is nothing you can do to see which files are moving. The "My Recent document" feature is a good remedy for this void.

View my Recent Documents

Click on the Start menu, find the "My Recent document" feature, hover over it, and soon the recently accessed files are displayed. So we can know if our privacy is being spied on.

Small tip:

If you suspect that the system files have been viewed by others, you can view them through these methods. If the computer is used by others, the best way is to set your Windows system password, or set the BIOS password, from the source to prevent others from moving your computer.