I am troubleshooting PCs and many times I'd like to find out what a user did before the PC or programs of the PC stopped working. The tool should at least collect information from:

• Add/remove programs information
• Windows Updates
• MRU lists in Registry
• System event log
• File modification dates on disk (today I use Search Everything)
• deleted files (recycle bin and really deleted) (today I use FTK Imager Lite)
• Connected hardware (also removed ones) (today I use NirSoft USBDeView)

I know there are programs which are used in Computer Forensics, but usually they take a complete disk and/or memory image and then analyze it on another PC. I don't need this feature, because

• I am allowed to make changes to the target PC
• It takes too much time
• I don't have so much disk space for doing the analysis
• I don't need to analyze (most) file contents later
• I am not trying to bring someone to court

I also don't need to analyze things which (usually) have no impact on the behavior of the PC, like

• chat logs
• email
• browser history

Besides collecting the information, the tool should be able to:

• run on the target PC directly, but without installation
• sort all data by time
• filter the data by time (define a date range)
• filter the data by event type

If it cannot filter, then it should be able to export to a common file format like CSV or Excel so that I can do the filtering there.

OS: Windows XP to Windows 8.1.

File system: NTFS

License: commercial use needed

Price: gratis and OpenSource preferred. Otherwise up to 100 € one-time price. No monthly payments.