Is there a way to find out what happened at what time?

[tony22]

I've been trying to track down what is causing file deletion on one of my drives. I've used a file recovery utility to determine that the last time I unexpectedly lost files was at 9:47 this morning. Is there something in Windows 7 that I can call up that will tell me what happened at any given time? Like what executables were running etc.

 

[richc46]

Try event viewer and see what that says

Just type those words in search.

 

[tony22]

Tried that after I posted my original message. I can't seem to get the search to show me what executables were running during the block of time around 9:47. I set up the Custom View but I can't figure out how to get it to show what was running. If I leave everyhting checked under Windows Logs it chokes and says I have too many things checked.

 

[seekermeister]

I don't think that there is a way to go back in history to track an event, but you might be able to track it in the future. I have only briefly scanned over this article, so I'm not positive that it is applicable or not:

Event Tracing: Improve Debugging And Performance Tuning With ETW

 

[richc46]

A cornucopia of information on event viewer

Working with Vista’s new Event Viewer

Will be similar in Win 7