I want to know if a PC from my office (running Windows 7) was used after a certain hour of the day. A simple file search gave me too many results; then, I have narrowed the search only to ETL files. From this search I learned the time stamp of the last shutdown (ShtdownCKCL.etl) and the time stamp of the last boot (snapshot.etl and others). I guess I already know what I wanted to know. But... Am I doing it the right way? Is there any better way to do it?