Find/sort files and folders based on when they were accessed/opened

Solution 1:

Well, if they were just browsing your computer, then you are out of luck. NTFS has a "last accessed" attribute, but it is disabled by default on Windows 7. If they changed any files, they would be located under the Date modified. Where were these files located? What kind of permissions are available (ACL)?

Windows DOES by default keep a log of every time a user logs in, unlocks the computer, etc. It would be under the Event Viewer's Audit Log.

Solution 2:

On any given folder, in the right pane, right click on the name header and select "more...", then scroll down to "Date Accessed" and tick the box, it will now show the date and time if any thing was written, changed or deleted from the folder (write), it will not show if it was just opened and looked at (read), something has to change for the date to be updated. This will not show you who accessed it, it could be a user or the system itself.

.

To enable Last Accessed (which will time stamp for a read and write), open an elevated command prompt and type this i and hit Enter

There will be a system performance hit if you enable it.

 fsutil behavior set disablelastaccess 0

To disable it

 fsutil behavior set disablelastaccess 1