pharcyde1
04-09-2005, 12:10 AM
ok is it possible to recover from a HDD if a windows network user installed something on a pc..i want to know like can you tell who was logged in and installed or copied files to that specific HDD? yes auditing is turned off on the local host and the domain. and i was also wondering does anyone know if you can trace ( from months ago) if a person on another pc remotely put anything on a computer? meaning say if tom installed (REMOTELY)microsoft word on another computer...is there a way that you could bring up some sort of log that would tell you when it was installed/copied there, and by whom it was installed/copied there by?