Can I find out when my laptop was used?

aliasojo

Or what it was used for?

Assume cookies and history have been deleted after use.

If I can find out what it was used for (I'm pretty sure for the internet rather than word processing for example), then I can pinpoint who it was that used it.

rmg1

You can look in the event log which will show entries for booting and logging off. Not sure what else it will show, though.

aliasojo

I'm in the event viewer now but I'm not entirely sure what I'm looking at/for tbh. There are rather a lot of entries and little makes sense to me.

JasX

well for starters there will be no entries for anything when your laptop was switched off...... hence the 'when it was in use' bit

aliasojo

That's what I thought but there are loads of Windows log entries for pretty much the clock round. Even for when I know the laptop was switched off. That's why I'm confused.

This entry would have been round about when I switched the laptop off last night....

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 10/04/2011 21:03:30
Event ID: 1532
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Laptop
Description:
The User Profile Service has stopped.

Then there are loads more entries from just after midnight onwards (I know the laptop wasn't being used at this point).

Log Name: Application
Source: Microsoft-Windows-EventSystem
Date: 11/04/2011 00:00:33
Event ID: 4625
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Laptop
Description:
The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 11/04/2011 00:00:33
Event ID: 1531
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Laptop
Description:
The User Profile Service has started successfully.

Those are just the first 2 entries after I had switched off, there are loads.

gonzo127

not entirely sure what you are looking for but if you are worried about someone (children?) using it after you have gone to sleep have you thought about turning the router off at night so that adds another layer of things the person using it has to sort out to use it, the other more extream method would be to remove the phone cable from the router to the socket and take it upstairs with you to bed then no one will be able to use the internet until you have plugged it back in again

free4440273

failing all that... look to key-logging software // careful though

aliasojo

It's nothing sinister, my eldest (the one with learning difficulties etc) seems to be going through a new phase and is doing things around the house (and to people) that are trivial but annoying. He denies everything so I really need to be sure of what's going on before I mark this down as another thing of his doing.

I don't mind him using the laptop, I do mind him lying (which he does constantly so it's difficult to know when he's being honest). Facts dont lie though so if I can find some factual way of finding out when it was used then I will know this was him. I will also then know if I have to be more vigilant of him during the night.

gonzo127

if someone knows there way around a computer it will be difficult to find conclusive evidence (have you checked the temp internet folder as the cookies might have been deleated but it doesnt always follow that they have deleated the files) other than something like keylogging which i personally dont like, you could always go for some parental control software but this might be going a little bit far.

actually how about some traffic monitoring software? more based around keeping an eye on your usage limits than what is being looked at, so you can make a note of the internet usage before you go to bed and then look again when you wake up, if its changed overnight you know someone has used the net over night.

if you find its being used over night you can ask your family and if no one owns up just say something along the lines of 'ok i know someone is using it because of this monitor, and since no one is going to own up i will be stopping all internet usage over night' and then follow this up by physically disconecting the router overnight, - this way you are not pointing your finger at any specific person, incase its not your eldest,

closed

If the time is correct, and there are entries in the log, it was on at the time

User Profile Service has stopped. is a sign of shutdown

The User Profile Service has started successfully is a sign of bootup

John_Gray

Of course you might get (a few) event log entries if the laptop was put into sleep or hibernate mode, but not if it was really, really, shut down.