Member Avatar for William_34

Dear all,

using Windows 10, I insert a USB stick in a PC, create a Word document and save it onto the USB stick.

Later I edit many times the document at different times and in different days but always working on the USB stick.

Eventually is there any possibility to trace the document's filename, date and time of editing? Even with sophisticated tools?

Regards

William

  • 3 Contributors
  • 2 Replies
  • 387 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

— short, practical summary (building on points from and ): Windows and Word often leave host-side artifacts even if the master document stays on a USB stick. Below is a compact checklist of the highest‑value places to look and quick commands you can run on the PC to spot traces.

Word/Office artifacts to check (AutoRecover, temp and unsaved files). Word can create AutoRecover (.asd) or UnsavedFiles entries and write temporary lock files (e.g. ~$filename.docx) on the host even when you edit from removable media. Search the AppData and Temp locations for those files: they often contain timestamps and sometimes content. 

dir /b /s "%USERPROFILE%\AppData\Roaming\Microsoft\Word\*.asd"
dir /b /s "%LOCALAPPDATA%\Microsoft\Office\UnsavedFiles\*"
dir /b /s "%TEMP%\~$*.*"

(learn.microsoft.com)

Windows shell/JumpList/MRU artifacts. Files opened or saved through Explorer and common dialogs are recorded in Recent/JumpList and ComDlg32 MRU areas; those contain link entries and paths (including drive letters) and useful timestamps. Look in the user profile NTUSER hive and the AutomaticDestinations folder for Jump Lists. Quick checks: 

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU"
dir /b "%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms"

These artifacts often reveal filenames and the order/times they were opened. (artefacts.help)

USB‑device, filesystem and timeline artifacts. Windows records attached storage in the system registry (Enum\USB, USBSTOR, MountPoints2) and in setup/driver logs; those keys store vendor/serial info and first/last connection times. If Word wrote temp files to the local disk, the MFT and the NTFS USN change journal will show create/modify records you can parse for file names and times. Also check thumbnail cache and Event Log entries for plug/unplug events. (artefacts.help)

Practical note: a managed or centrally backed‑up PC can have additional server logs/snapshots. If a full forensic timeline is needed, image the host volume and parse NTUSER.DAT, MFT, USN, Jump Lists and Word AutoRecover files with a DFIR toolset rather than relying on live deletes or clearing of MRU lists.

Recommended Answers

All 2 Replies

Member Avatar for rproffitt

The answer is simply yes. You didn't give any background on the host PC and if it was remotely managed by a top notch IT staff.

If you don't want work to know what you are editing, don't use company PCs. It's that's simple.

Member Avatar for rubberman

It is also possible that backup versions of the file stay on said PC, depending upon how the OS and/or Word are configured.

commented: Excellent. (Mr. Burns) +12
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.