If we suspect that someone uses our PC when we are not at home, in this guide we will show you how to check if anyone has used our PC, what he watched and what he did.
The article is aimed at looking for evidence on using a computer, to know where you can look to track down what has been done.
By collecting all the evidence we will always be able to find out who used our computer without permission and to remedy it.READ ALSO: Find out who enters the PC and if we are spied on the computer
How to check computer access
There are many things that testify to the use of a computer: restarting, unsuccessful attempt to access the Windows account, launching programs, browsing the Internet, opening files, and more. But if our “anonymous user” is smart enough, he will hardly leave such obvious traces of his passage, perhaps erasing the history of all the browsers present on the computer.
To verify access to the computer we have several advanced tools that we can use, many of which are “invisible”.
Check the Windows event log
The tool used by every computer analyst is the control of the Windows registry useful above all to find out the causes of errors or crash of the PC. The Windows event logs it can say a lot about what the computer does, not just if something goes wrong.
To open the event viewer, press the Start menu at the bottom left, we search the Event viewer, and open it.
Sifting through the application registry you will find among the many useless information if there has been using during a period of time in which the computer has been left unattended. The menus in which we can search for access data are Windows registries -> System is Windows registries -> Security.
Use the WinLogOnView tool
Since the items to look for in the event viewer can be difficult for a novice user to interpret, we can help by installing WinLogOnView on our computer, a free tool developed by the famous Nirsoft house, known for its countless useful tools for any situation.
We start the executable file contained within the ZIP file and, after a few seconds, we will have access to all the login data made on the computer in use. To understand who has entered our computer, press on the column entitled Logon Time, so as to view the accesses in chronological order, from the most recent to the most remote: comparing it with our times and times of use, it is not difficult to understand when the computer was used without our permission.
Check recent files
Checking for recently modified files is one of the easiest ways to find out whoever got their hands on our computer without permission; to perform this type of check just open the File Explorer app on Windows, go to the Quick Access menu in the left column and scroll down the page until you find Recent files.
If you are lucky you can find a document, an image or any other element downloaded or created “by the intruder” that clearly proves the use of the computer in the last hours, perhaps while we were away from home. Wasn’t our intruder very skilled? You should also check the history of web browsers, perhaps using a tool like History Viewer to see the history of sites visited with IE, Firefox, Chrome.
Check for latest changes with Everything
Another very useful tool to check if someone has used our computer without permission is Everything, a quick file and folder search tool that lends itself perfectly to our purpose.
Once downloaded and installed on our computer we start the app and, at the end of the upload, we press on the column the Last edit, so as to sort all the files on the PC in chronological order (from the most recent modification to the most remote modification).
Scrolling through the list we will view every single file modified or created by Windows or programs (impossible to delete all), including files for browser profiles or for opening a specific program. With a lot of patience and willingness, we will be able to reconstruct the use of our PC from start-up to shut down, so as to know exactly what has been done in our absence.
Spy on the computer webcam
If our PC is equipped with a webcam, we can use it to take a photo of all users who access the computer and schedule the taking of a photograph at regular intervals, so as to have irrefutable proof of unauthorized use.
To take these photos in secret we will have to use the WebCamImageSave tool, also from the Nirsoft house.
To find out how to best use this tool and configure it in auto-start, please read our guides How to activate the webcam when the PC is turned on automatically is How to take photos and videos from the webcam periodically.
Use a keylogger
If the previous methods have not worked, we will necessarily have to install a keylogger on the PC, so as to record all the pressed keys and the open programs in a small “secret” text file, which we can check later.
The best ones to use on Windows 10 are Hooker and Spy Monitor Screen Recorder, both available for free.
Once set in auto-start they will monitor all the keys pressed on the keyboard and will also display the open programs, the keyboard shortcuts used, and so on, hiding the collection in convenient text files.
Other PC keyloggers can be viewed in our guides How to install a Keylogger to secretly spy on a PC is KeyLogger Windows Spy: 8 Free Programs.
Conclusions
By combining all the methods we have shown above, we will be able to expose any clever user (but not too much) who will try to use our computer without permission, so as to find out what he has done and immediately remedy the thing.
To avoid problems in the future it is better to always set a login and lockout password for Windows, as seen in our guide Protect access to Windows PC with lock screen and password.
If, on the other hand, we want other people or family members to use the computer without giving access to our personal account, we advise you to read our guides on how to create accounts on Windows and manage computer users or How to make friends and guests use the PC separately and safely.
