I am troubleshooting PCs and many times I'd like to find out what a user did before the PC or programs of the PC stopped working. The tool should at least collect information from:
- Add/remove programs information
- Windows Updates
- MRU lists in Registry
- System event log
- File modification dates on disk (today I use Search Everything)
- deleted files (recycle bin and really deleted) (today I use FTK Imager Lite)
- Connected hardware (also removed ones) (today I use NirSoft USBDeView)
I know there are programs which are used in Computer Forensics, but usually they take a complete disk and/or memory image and then analyze it on another PC. I don't need this feature, because
- I am allowed to make changes to the target PC
- It takes too much time
- I don't have so much disk space for doing the analysis
- I don't need to analyze (most) file contents later
- I am not trying to bring someone to court
I also don't need to analyze things which (usually) have no impact on the behavior of the PC, like
- chat logs
- browser history
Besides collecting the information, the tool should be able to:
- run on the target PC directly, but without installation
- sort all data by time
- filter the data by time (define a date range)
- filter the data by event type
If it cannot filter, then it should be able to export to a common file format like CSV or Excel so that I can do the filtering there.
OS: Windows XP to Windows 8.1.
File system: NTFS
License: commercial use needed
Price: gratis and OpenSource preferred. Otherwise up to 100 € one-time price. No monthly payments.
