I've been trying to track down what is causing file deletion on one of my drives. I've used a file recovery utility to determine that the last time I unexpectedly lost files was at 9:47 this morning. Is there something in Windows 7 that I can call up that will tell me what happened at any given time? Like what executables were running etc.
Tried that after I posted my original message. I can't seem to get the search to show me what executables were running during the block of time around 9:47. I set up the Custom View but I can't figure out how to get it to show what was running. If I leave everyhting checked under Windows Logs it chokes and says I have too many things checked.
I don't think that there is a way to go back in history to track an event, but you might be able to track it in the future. I have only briefly scanned over this article, so I'm not positive that it is applicable or not:
Event Tracing: Improve Debugging And Performance Tuning With ETW
A cornucopia of information on event viewer
Working with Vista’s new Event Viewer
Will be similar in Win 7
Last edited by richc46; 24 Jan 2010 at 19:15.
Quote