Read file histry from a regular XP based laptop without prgramming/monitoring software installed possible?

Question

Dear IT pro,

I know quiet some in using and maintenance, but nothing on programming... I have an investigation-question on an action being performed regarding a WAV file...  I use Cool Edit pro for registering music. It seems one of my tracks has been sabotaged...  The track of the evening-recording was made and saved well. When starting post production that evening (the file was not reopened by myself then), it started surpringly to make a new peakfile (audioinformation for Cool Edit), and it  showed out that that track was overwritten with a registration from that very morning, while keeping its name as it was registered in the evening. I do not know who did it by accident or on purpose, but I want to see the file histry, and the history of actions being performed on this XP laptop that very day at least to define what happened. It is said that XP monitors every action. So I would like to acces that information for investigation. There are no additional programming or monitoring applications installed... I hope someone can give me help in learning. By the way PWR Datarecovery did not give remains of the origibnal track recognised in NTFS. For this Lst&Found n Fat32 was better, it also revived remains... Thanks.

(I was building a registration on a choral singing with two microphones. One mic was 90* angle towards a small organ and lead singer being registered two times mono (L+R), and the other mic was in a 180 degree opposite positiseen frm the singer with a mic-angle of 270 degree for registering the Choral in stereo, with very little signal from the lead singer and his organ coming from behind in the background. In the mix the two tracks together would lead to a simulated surround registration, with copying tracks in other sound/balance/filter settings next to the originals on the DWA mixtable. The mastering is now in vain, too bad...)

Answer 1

Hi,

first of all: This forum only covers Small Basic - a development environment / language designed for kids and beginners.

AFAIK there is no such thing per default on windows xp. Windows has some build in mechanisms to audit access and modification of files which could be activated.

In general it seem that you didn't set up everything correctly. Normaly you should have an environment where:

- every user is using his own account

- files / data is protected in a way that not everyone can access or alter it

Maybe you can check the event logs to see who logged on (in the hope that there is not just one account that is used all the time!)

I would suggest to look for a technet forum that covers windows xp in case you want more details about technical possibilities on Windows XP.

With kind regards,

Konrad