Logging Access to Files on Local Desktop PC

March 28, 2024 6:08 PM

I've got a folder with ~200 files in it (mostly .pdf, but also images, .doc/.docx, .rtf, .html, txt/.md). I'd like to log when I open any of these files. I'd also like to log when I left-click files with the folder window in preview mode example [imgur link]. The folder does not have subfolders, but is six levels deep in the folder hierarchy.

I suspect I'm not finding any of these files in local searches and could delete them if I knew for certain.

I've looked on prefvious askme's using:
"windows" "desktop" "folder" "log" and
"log file access", but nothing relevant came up.

The computer is my own, in my own company office so I don't care about violating anything.

Is this something that exists or would a script be the solution?

My system is Windows 10, 64bit..

posted by unearthed to Computers & Internet (5 answers total)

I suspect that what you are looking for is the file system audit logs. They are not enabled by default and are stored in the event log.

Start here: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder

The only word of caution is that that the deluge of information in the resulting security event log is such that most systems I've worked with have it disabled because it is, well, a surprising ton of data in a format that requires you to really do a deep dive on how things work under the covers to make sense of.
posted by SegFaultCoreDump at 8:25 PM on March 28 [2 favorites]

Unix had the idea of 'atime', i.e. the time that a file or folder was last accessed. NTFS, the underlying file system Windows, also has this, so it should be as simple as adding the column to Detail View in Windows Explorer. Select View -> Details, then right-click on the column headings -> More... -> scroll down and select 'Date Accessed'.

If it's not available for that disk or disk partition, you may need to turn it on for the disk drive or storage space in question. Example tutorials exist online (e.g. here) which shouldn't put your data at risk -- and my answer here comes with the usual warnings about keeping data safe by having backups you trust to be able to restore your data.
posted by k3ninho at 6:35 AM on March 29 [1 favorite]

Just tested k3ninho's excellent answer and it does look like the preview pane modifies the last access time. So, assuming you don't need a log of every access and just the time you last accessed it, it should do just what you want.

Note that if you don't want to switch to details view to view the last access time, you can also get to it via right click > Properties on a per-file basis, or if you're handy with the command line you can also get this using the following command in Powershell (after changing to the folder with the relevant files):
gci . | select name, lastaccesstime

Or in the older command prompt:
dir /ta
posted by Aleyn at 5:47 PM on March 29

Response by poster: Thanks very much SegFaultCoreDump, I'll probably do that - although it's a bit fiddly to set up, e.g. I can't even find object access auditing let alone find how to change its status. I'll have a go when I have a clear head and a bit of time.

k3ninho and Aleyn thanks but as far as I can tell (from adding Date Accessed to two different folders the dates are all very recent - and look like the most recent backup dates for the individual files - file dates and times are exact for groups of files).
posted by unearthed at 9:00 PM on April 1

It'd stand to reason that backups would modify those dates, yes. Copying files may or may not modify them, but if your backup solution also does compression it almost certainly accesses the file contents which would trigger that date update.

The auditing feature SegFaultCoreDump mentioned is likely only available for Pro and Enterprise versions of Windows, so if you don't have that you probably won't have the ability to access that feature without upgrading.
posted by Aleyn at 12:53 PM on April 3