Somebody read my files: which ones and when?

Hi,

I think –I am sure, actually– that somebody at my workplace has been reading my documents, snooping into my files, etc. I would like to know how they did it, but more importantly, which files they read and when. Is that possible? Is there any procedure I should follow to determine that, any software I could download? My attitude and strategy from now on will change according to that.

I am not asking about the best way to protect my files, I want to know if I can determine which ones (and when) have been read.

I have a Dell with a Windows 2000 OS, and though I am the administrator of that computer and several other people are only Power Users, I know they read my files. There’s no network.

This is a very important issue for me: I would appreciate any answer.

 

I'm not sure about the Windows 2000, but in Windows XP, set folder options to Show Hidden Files, then look in:

c:\Documents and Settings\[user name]\Application Data\Microsoft\Office\Recent

This folder would contain links to documents that were accessed. The date the link was created is when they were first accessed. This is assuming that the documents were Windows Office apps, that everyone has a unique login ID and that the person responsible didn't clean out all traces of his activities.

 

Hi exebbeche

... and welcome to Wilders

Can you tell us more on where these documents are saved?
You mention you are the Administrator of the system, are they in C:\Documents and Settings\Administrator? Anything there should not be accessible by another account. Has your account/password been compromised? What type of logon events are you logging?

Regards,

CrazyM

 

Hi exebbeche,
As Brinn has mentioned, Recent documents would probably give you a good idea as to what has been viewed. If your PC uses only one account then i'd suggest you password protect your account and log off when you are away.
There is however software which can protect your files which you do not wish anyone to view. One which springs to my mind would be FolderLocker, which you can the easily hide files from view with a password. Another would be to use Encryption, although a bit more of an inconvenience if you frequently modify them IMO.

 

Hello everybody:

Thanks a lot for your comments.

Brinn:

I am rushing out now (I have to go to work) but I will check this evening and let you know if it worked; yes, they are Word documents mostly, and yes everybody has a unique log in ID, but one possible problem is that this situation has been going on for a long time (maybe a whole year) and I wasn’t aware of it.

CrazyM:

Thanks for your welcome. In fact I have been using Wilders’ advice on firewalls, anti-virus software, etc., for quite a while but I guess this is my first posting.

I am the administrator but log in as a Power User with my own ID, so does everybody else. These files were saved as hidden files in a hidden folder in ‘My Documents’ –in ‘my’ My Documents, not in the Administrator’s. Perhaps my password has been compromised, I can’t tell. I have already changed it. I’m not sure I can follow you when you ask ‘What kind of logon events are you logging?’ –I may not totally illiterate when it comes to computers, but I am by no means an expert, just a user.

Tony62,

Thanks a lot, I’ll keep that in mind for the future, now my priority is to determine how much information (from personal stuff to business letters) has leaked into the wrong hands.

I’ll keep you guys posted, thanks a lot for your help, please keep in touch.

Exebbeche

 

You can probably assume that all of them have leaked into the wrong hands. Maybe not, but it seems likely considering how long it has been going on.

Don't let on that you know. You may be able to figure out who has been doing it by planting fake documents in the same location that you've been storing your documents. You can make it more believable by mixing in genuine documents that you don't care if anyone reads them. Put the documents that you don't want anyone to see in another location and/or protect them with encryption. Even with encryption, I'd be reluctant to leave the files on that computer. I would store the files on a Zip disk or CD-RW disk and take them with me, or lock them in my desk.

Phil

 

Hi,
The best way is to right-click a file and go to properties. Then, you'll have three dates - created, modified, accessed. You're interested in last accessed. Recently Opened documents lists could be emptied - by using MRUBlaster or CCleaner.
Mrk

 

The only problem with that is the 'Accessed' will only show the actual viewing you are doing on that file at that very moment by *you*, unless I am doing something 'wrong'

I've also wanted to previously check a file when it was last worked on and noticed it giving the actual date and time of the very current viewing by me at that moment. I just looked at 3 files I know have not accessed in over a month and the Accessed was today's date and the actual time I looked at them.

TAS

 

Hi,
You're right, but here's the correct solution.
Open explorer.
Go to any folder.
Display your data in details
You will have now categories - name, size, type, date modified.
Right click near date modified and you can add more categories.
Date accessed does not show, so go for more.
Select date accessed and it will show you when the file was last accessed in the list.
Mrk

 

Thanks for that info Mrkvonic... that should do nicely.

TAS

 

Who read my files, which ones and when?

Hello people,

Thanks to you all for your advice; I am afraid I will need more input, though.

Dear Brinn,

I tried what you suggested but unfortunately I only gained access to the last two months of activity of the other users.

Dear Mrkvonic,

Unless I have been doing everything the wrong way your solution gives me the last person who saved each document, not the last person who opened it.

QUESTION:

I need to know the name of the person who did this, is that possible?

I feel I bit silly actually. I am the ‘Administrator’ of the computer and not even once did I peek into any file that wasn’t mine. Snooping into other people’s lives –plans, job application letters, business proposals, personal stuff– is wrong, as simple as that.

 

It looks you're going to have to hope this person does it again.

 

Hi,
The accessed tab will tell you when the file was last time read.
I'll show you an example - see attached image.
Look at my windows folder - it was last accessed at 2am, and it wasn't me doing it. Ir was the Microsoft Anti-Spyware doing its scan. Now, MSAS didn't change the files but it did access them, so if you enable the Accessed tab in the explorer, you will know when your files were touched.
And then, you may start narrowing down who was there at the workplace at which hour. Maybe you can give them 'work', so they stay overtime, one person at a time. Let them close the office after you. And then, check every morning after that if someone browsed your docs.
And if you want to prevent it, maybe you could try AxCrypt, encryption program.
Mrk

 

Here you go.. I've never used it, so I can't vouch for it, but it looks like just what you're looking for..
http://www.snapfiles.com/get/tracksrevealer.html

I never in a million years thought I'd be saying this, but this actually seems like it might be an appropriate situation for a keylogger <cringes silently> Hopefully you're being truthful about the situation (I have no reason to doubt you, but on the internet you can never be sure). If I were in this situation, I would want to know not only when they accessed those files, but what they were doing with them (emailing them to a competitor? etc..)
http://www.snapfiles.com/freeware/security/fwaccessmonitoring.html
The paid software may even do more that would be specifically appropriate to this situation
http://www.snapfiles.com/Shareware/security/swaccessmonitoring.html

You might also want to take a look at files that have been deleted..
Free: http://www.pcinspector.de/file_recovery/uk/welcome.htm
Paid: http://www.recovermyfiles.com/