How can I Detect retroactively which program/user Changed a File or Folder?

Question

Hello there,

I have one question :

I have a program that fails to Run because a change has been done in a specific folder under : C:\ProgramData\XZY

This I know for sure is the rootcause.  

Though, in order to avoid this problem to appear on other machines, I would like to know which program/user made changes in the folder : C:\ProgramData\XZY  and "tempered" the data in there.

There is any way to find this information out, retroactively? 

Thanks for the help!

Answer 1

Hi Dave,

thanks for the help and the prompt answer. Really appreciated!

The problem I have is that , apparently, some files got deleted and I do not know how and which program did the modification in the folder.

I will try to find an alternative way to investigate this problem! Thanks again for the help,

Best,

Nico

Answer 2

Hi Nico

Sorry, no, Windows does not store a log of who or what application accessed files in that folder, the only hint of what happened would be the data and time modified on whatever file(s) had changed, that may give you a clue if there was someone using the PC at that time . . .