Is Someone Using Your PC? Check for Snoopers

Tips to check if someone is snooping on your PC

Your computer is loaded with private information. The documents and files stored on your hard drive are a gold mine for an identity thief, including emails, your tax return, and a list of your passwords. Even if your data isn’t stolen, it might be embarrassing if a friend or family member who wasn’t expecting it accesses it. You should already be aware of the significance of protecting your computer with a strong password, a thumbprint, or facial recognition.

Having said that, we’ve all occasionally been called away to answer the phone or the door and forgotten to lock our computers. Some of us might even occasionally lend our laptops to friends and family. Your data is most likely to be accessed during these times without your knowledge. Even though there’s a chance that this wasn’t done with malicious intent, it’s still in your best interests to learn what was accessed and when. You’ll see how to do this from us. Even if you have never shared your computer with others or left it unlocked, many of these tips can still be useful in helping you find recently used files that are difficult to find.

Check the recent document lists.

In the File menu of most programs, you can find a list of recently accessed documents. The lists in Word, Excel, and PowerPoint will sync between every installed version on every one of your devices if you have a Microsoft 365 subscription. They will also reflect any files that have been opened or edited using the web versions. Make sure Home is selected in the sidebar by clicking “File” at the top of the window, then look in the Recent tab, which is located beneath the search box.

Nothing suspicious should be present in your program menus, which is a good sign that no one has been prying into your computer. But what if they attempted to open a file without the associated program? Even if Word is set to launch automatically whenever you double-click a.doc or.docx file, you can open and edit Microsoft Word documents using WordPad, a program that comes with Windows. Therefore, a spy only needs to right-click a document and select to open it in WordPad from the context menu in order to prevent it from appearing on your Recent Files list.

You don’t want to have to check every installed program on the off chance that someone has used it to spy on you, but WordPad’s own recent documents list shows whether someone has used it to open a file without Word being involved. Fortunately, you don’t have to because Windows keeps a record of everything that occurs on your computer to create a useful reference. By opening a new window and selecting Home in the sidebar, you can find a list of recently accessed files in File Explorer in both Windows 10 and 11.

Files that have recently been opened are also displayed in the timeline in Task View in Windows 10. You can access this by pressing Windows key + Tab or by clicking the Task View button on the taskbar, which is typically located to the right of the Cortana icon and looks like a film strip. Windows 11 also has Task View, and its icon resembles a white square on top of a black square that is slightly out of alignment.

Click ‘More’ to view a longer, more thorough list, as this only displays the six files that were accessed most recently. This will show you the times and dates that each file was last opened, which will allow you to spot any entries that weren’t made by you.

Sort your files by date.

A file’s time stamp is updated each time it is modified. A program will typically only recognize a change as having been made if you edit its contents and save the outcome. Therefore, anyone who opens a file, simply looks at it, then closes it without making any changes may get away with it—unless the program they used to open the file saves status changes, such as the position of the cursor, along with any edits. Any scrolling down to read a document that doesn’t fit on the screen in this situation might reveal them.

If you believe someone has modified one of your files, open the Run window by pressing Windows key + R, type recent, and then press Enter. This displays files that have recently been edited on your computer in a File Explorer window. The most recently accessed item will be at the top of the list when you click the “Date modified” heading.

Instead of scouring the entire computer, open a File Explorer window and go to the folder that contains the file. Click This PC in the sidebar, then double-click C: in the main window if you’re unsure what has been accessed. Open your folder inside the Users folder after doing so. Select all of the files in your user folder by typing “*” in the search box at the top right of the File Explorer window.

Right-click View, choose “Sort by,” then “Date modified” from the menu options in Windows 10. In Windows 11, select “Date modified” under Sort from the toolbar. Every time, this arranges the results so that the most recent file modification is at the top of the list, making it simple to scroll through each one and compare the modification dates to the times you know for sure you weren’t at your computer.

A word of caution If your files are synced online or if macros or other scripts have been set to automatically update them every so often, the dates on recently edited files may be influenced by edits that were made elsewhere.

Check the time your computer was turned on.

Check the time your computer turned on by using the free LastActivityView program from NirSoft (nirsoft.net/utils/computer activity view.html). A list of events will be shown in reverse chronological order when you extract the downloaded ZIP file and run the “LastActivityView.exe” file.

Expand the window until you can see at least all the columns between Action Time and More Information, because much of what you’ll see is still generated by Windows itself rather than any evidence of activity by a person. Windows depends on a large number of the entries with “Microsoft Corporation” in the More Information column. Just like with our other advice, focus on times when you know you weren’t using your computer.