LastActivityView is a popular, lightweight freeware tool developed by NirSoft that consolidates fragmented system data into a comprehensive chronological timeline of user actions and events. Digital forensics investigators and IT administrators frequently rely on this portable utility to reconstruct user behavior during security incidents, corporate audits, or system failures. Where Data is Gathered
Instead of running constantly as a background monitoring agent, LastActivityView queries hidden Windows artifacts to compile historical event logs. Key sources include:
The Windows Registry: Pulls Least Recently Used (MRU) lists, user shell folders, and software configuration states.
Windows Event Logs: Extracts system startups, shutdowns, user logons, logoffs, and application installations.
Prefetch Folder (C:\Windows\Prefetch): References data created by Windows to optimize application launching, confirming exact executable file executions.
MiniDump Folder: Identifies the timestamps of system crashes and blue-screen events. Trackable System Events
The tool populates an organized table mapping actions directly to their Action Time, Description, Filename, and Full Path. Forensically relevant behaviors trackable via the utility include:
Executable Execution: Logs the exact second an .exe file was run on the machine.
File Interactivity: Pinpoints when folders were viewed in Windows Explorer or when files were accessed via standard Open/Save dialog boxes.
Network Status Changes: Captures connection and disconnection timestamps for Wi-Fi and wired networks.
Software Modifying: Displays software installation, update histories, and system restore point configurations. Operational Advantages in Forensics ManageEngine What is LastActivityView and how to use it – ManageEngine
Leave a Reply