Professional Documents
Culture Documents
30
Copyright (c) 2012 - 2017 Nir Sofer
Web site: http://www.nirsoft.net
Description
===========
System Requirements
===================
This utility works on any version of Windows, starting from Windows 2000
and up to Windows 10. Both 32-bit and 64-bit systems are supported.
Known Limitations
=================
Versions History
================
* Version 1.30:
o Added 'Quick Filter' feature (View -> Use Quick Filter or
Ctrl+Q). When it's turned on, you can type a string in the text-box
added under the toolbar and LastActivityView will instantly filter
the actions list, showing only lines that contain the string you
typed.
* Version 1.27:
o You can now choose whether to read the archive log files (Options
-> Read Archive Log Files)
* Version 1.26:
o Added 'Sleep' action.
* Version 1.25:
o LastActivityView now automatically reads archive log files
(Archive-*.evtx) .
* Version 1.20:
o Added 'Wireless Network Connected' and 'Wireless Network
Disconnected' actions (For Windows Vista and later). This information
is collected from Microsoft-Windows-WLAN-AutoConfig/Operational event
log.
* Version 1.16:
o For 'Run .EXE file' actions, the version information of the .exe
file is now displayed in the 'More Information' column.
* Version 1.15:
o Added option to show only the activity in the last xx
seconds/minutes/hours/days (In 'Advanced Options' window).
* Version 1.12:
o You can now choose the desired encoding (ANSI, UTF-8, UTF-16) to
save the csv/xml/text/html files. (Under the Options menu)
* Version 1.11:
o LastActivityView now uses the 8 date/time values stored in the
Prefetch files of Windows 8 and Windows 10 ('Run .EXE file' action).
* Version 1.10:
o Fixed LastActivityView to detect the 'Run .EXE file' action on
Windows 10.
* Version 1.09:
o Explorer context menu inside LastActivityView: When you
right-click on a single item with a file or folder while holding down
the shift key, LastActivityView now displays the context menu of
Windows Explorer, instead of the LastActivityView context menu.
* Version 1.08:
o Fixed bug: LastActivityView failed to remember the last
size/position of the main window if it was not located in the primary
monitor.
* Version 1.07:
o Added 'Copy Files List' option.
o Added 'Open Folder In Explorer' option.
o Fixed to find the correct item when typing the string you want to
search into the main List View.
* Version 1.06:
o Fixed to show properly the folder path of 'View Folder In
Explorer' action on Windows 8.1 .
* Version 1.05:
o Added 'File Extension' column.
o Added secondary sorting support: You can now get a secondary
sorting, by holding down the shift key while clicking the column
header. Be aware that you only have to hold down the shift key when
clicking the second/third/fourth column. To sort the first column you
should not hold down the Shift key.
* Version 1.04:
o Fixed to display date/time properly according to daylight saving
time settings.
* Version 1.03:
o Added secondary sorting: When clicking the 'Description' column
header, the list is sorted by the Description, and then by the
'Action time' column.
* Version 1.02:
o User information is now displayed for 'User Logoff' event.
o Fixed the flickering occurred while scrolling the actions/events
list.
* Version 1.01:
o Added 'Mark Odd/Even Rows' option, under the View menu. When it's
turned on, the odd and even rows are displayed in different color, to
make it easier to read a single line.
After you run LastActivityView, it scans your computer and displays all
actions and events found on your system.
You can select one or more items and then save them into
xml/html/csv/tab-delimited file (Ctrl+S) or copy them to the clipboard
(Ctrl+C), and then paste the data to Excel or other software.
Actions/Events List
===================
In the following section, you can find the list of all sources that
LastActivityView uses to collect the activity information and how to
optionally delete them.
Be aware that deleting any data from your computer is on your own risk,
and I cannot give any kind of support for people who want to recover data
they deleted from their computer according to this article.
* Open/Save MRU list in the Registry: Every time that you choose a
filename in a standard open/save dialog-box of Windows, a new Registry
entry is added under the following key:
On Windows XP and previous systems:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComD
lg32\OpenSaveMRU
On Windows 7/8/2008:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComD
lg32\OpenSavePidlMRU
LastActivityView uses the above Registry keys for the 'Select file in
open/save dialog-box' event.
If you delete the entries under the above Registry keys (with RegEdit),
Windows will not rememeber your last saved file/folder.
* Recent Folder: Every time that you open a file, a new shortcut to
this file is added to the recent folder of Windows, located under
C:\Documents and Settings\[User Profile]\Recent or C:\Users\[User
Profile]\Recent
LastActivityView uses the recent folder of Windows to add the 'Open
file or folder' event. You can delete this type of event simply by
deleting all shortcuts under the recent folder of Windows.
LastActivityView uses the above Registry keys to add the 'View Folder
in Explorer' event. If you delete the subkeys under the above Registry
keys (With RegEdit), Windows will "forget" the settings of all folders.
* Software Uninstall Registry Key: The 'Software Installation' event is
taken from the following Registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
Warning !!!!
If you delete any Entry from these Registry keys, you'll not be able to
uninstall the software in the future !
Command-Line Options
====================
/stext <Filename>
Save the actions and events list into a regular text file.
/stab <Filename>
Save the actions and events list into a tab-delimited text file.
/scomma <Filename>
Save the actions and events list into a comma-delimited text file (csv).
/stabular <Filename>
Save the actions and events list into a tabular text file.
/shtml <Filename>
Save the actions and events list into HTML file (Horizontal).
/sverhtml <Filename>
Save the actions and events list into HTML file (Vertical).
/sxml <Filename>
Save the actions and events list into XML file.
License
=======
Disclaimer
==========
The software is provided "AS IS" without any warranty, either expressed
or implied, including, but not limited to, the implied warranties of
merchantability and fitness for a particular purpose. The author will not
be liable for any special, incidental, consequential or indirect damages
due to loss of data or any other reason.
Feedback
========