I want to know if a PC from my office (running Windows 7) was used after a certain hour of the day. A simple file search gave me too many results; then, I have narrowed the search only to ETL files. From this search I learned the time stamp of the last shutdown (ShtdownCKCL.etl) and the time stamp of the last boot (snapshot.etl and others). I guess I already know what I wanted to know. But... Am I doing it the right way? Is there any better way to do it?
Now I'm playing with the Event Viewer. However, it's much more detailed than I need, and I haven't find a way to print it.
In case you can't find a better way, use shift-printscreen to capture the screen Then paste it to irfanview, Photoshop or whatever so you can edit it then you can print what you want from there ...T
I did that yesterday. The image was added to the other documents. But, in terms of presentation, the better document is still the HTML page generated by UltraSearch. The time stamp of the ETL files shows, in a clear and organized form, all the information I need. BTW, I'm not trying to incriminate someone: it's the opposite. A person of my office "kind of" accused me of leaving on (all night long) a PC and the air conditioner. It's a plain lie, but mean people use to be also stupid, and that person was stupid enough to include a computer in the story. Gotcha.