Can I find out when my laptop was used?

aliasojo

closed wrote: »

If the time is correct, and there are entries in the log, it was on at the time

User Profile Service has stopped. is a sign of shutdown

The User Profile Service has started successfully is a sign of bootup

John_Gray wrote: »

Of course you might get (a few) event log entries if the laptop was put into sleep or hibernate mode, but not if it was really, really, shut down.

That's what I don't get, I definitely 'shut down' but if it was restarted just after midnight then is it possible that something else started it rather than a person I mean?

The entries go on all night so clearly the laptop wasn't off again after it was switched on at midnight, when I lifted the lid this morning I was greeted with Windows.

Eldest isn't really computer savvy so wouldn't have been able to cover his tracks well, he does know how to click on the CC icon though.

Just checked the temp folder. There's not much there for during the night but there is a text file at 3am ish saying windows defender updated. I take it this could only have done so if the laptop was on at that time?

enigma52

put a password on the pc and only let him use it under supervision.

aliasojo

He has his own laptop.

His reasoning for using mine (if indeed it was him) wouldn't have been as simple as *just* wanting to go on the internet or whatever. His actions can be complex and are often not for nice reasons. Part of his difficulties unfortunately.

closed

If there are entries in the log, it was on, if you did a proper shutdown or hibernate or suspend, then someone made it come on, it can't just happen. Could be someone else?

intranix

When you say it definately shut down, did you just close the lid, press the power button, and did you watch it actually shut down/off. Sometimes a windows service can stop a laptop shutting down.

It's possible that if it wasnt shut down (as in, you didnt see it power off), that it remained on and windows update ran at 3am (default) and then rebooted it. Leaving you with the logon/welcome screen when you came back to it this morning.

aliasojo

closed wrote: »

If there are entries in the log, it was on, if you did a proper shutdown or hibernate or suspend, then someone made it come on, it can't just happen, could be someone else.

Ok thanks, I just wanted to make sure some sort of program (or hidden nasty) on the pc couldn't have started the thing up again.

That's why I wondered if there was a way to see what was accessed, that would've likely have given a pointer to the right person.

jayme1

what antivirus do you use? avast, and most others, have a 'Stats' tab which shows when the computer was on and off, you can also sort of tell what was used by selecting the different shields.

but the best way to limit access to the computer is set yourself up as Admin with a password, then create new user accounts for everyone else, then install Windows Live Family Safety and use it to restrict access, view logs ect.

I would definately set your laptop to use a password that will stop access.

closed

search for all files changed in the last 24 hours then sort in date order. recuva might find deleted internet history files, and there are various index.dat viewers available that will pickup browsing history, unless inprivate browsing has been used, or they have been cleaned up

aliasojo

intranix wrote: »

When you say it definately shut down, did you just close the lid, press the power button, and did you watch it actually shut down/off. Sometimes a windows service can stop a laptop shutting down.

It's possible that if it wasnt shut down (as in, you didnt see it power off), that it remained on and windows update ran at 3am (default) and then rebooted it. Leaving you with the logon/welcome screen when you came back to it this morning.

I clicked shut down and waited until the screen had gone blank and the light went out before I closed the lid.

I sometimes link my laptop to the tv to watch films on so I have the settings set for 'when the lid closes, do nothing' (or whatever the actual wording is). I never just take this on trust though so I always wait before closing the lid after I've selected the shut down option.

I have no doubt that it was shut down properly and at what time.

bluesnake

is your laptop of the type tha\t has a built in camera, or do you have a camera constantly connected? Is so, also put a large clock behind you so the camera catches that too.