I am troubleshooting PCs and many times I'd like to find out what a user did before the PC or programs of the PC stopped working. The tool should at least collect information from:

  • Add/remove programs information
  • Windows Updates
  • MRU lists in Registry
  • System event log
  • File modification dates on disk (today I use Search Everything)
  • deleted files (recycle bin and really deleted) (today I use FTK Imager Lite)
  • Connected hardware (also removed ones) (today I use NirSoft USBDeView)

I know there are programs which are used in Computer Forensics, but usually they take a complete disk and/or memory image and then analyze it on another PC. I don't need this feature, because

  • I am allowed to make changes to the target PC
  • It takes too much time
  • I don't have so much disk space for doing the analysis
  • I don't need to analyze (most) file contents later
  • I am not trying to bring someone to court

I also don't need to analyze things which (usually) have no impact on the behavior of the PC, like

  • chat logs
  • email
  • browser history

Besides collecting the information, the tool should be able to:

  • run on the target PC directly, but without installation
  • sort all data by time
  • filter the data by time (define a date range)
  • filter the data by event type

If it cannot filter, then it should be able to export to a common file format like CSV or Excel so that I can do the filtering there.

OS: Windows XP to Windows 8.1.

File system: NTFS

License: commercial use needed

Price: gratis and OpenSource preferred. Otherwise up to 100 € one-time price. No monthly payments.

1 Answer 1


I seemed that there's no such tool out there, so I wrote my own: Live System Timeline Builder. It combines many NirSoft utilities and exports into Excel format.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.