Windows Event Logs

Event logs are saved by Windows in order to record certain actions taken by the operating system, or software on the system.

In Windows 7 you should see these files saved to this location:

C:\Windows\System32\winevt\Logs

These can be viewed simply by typing in 'Event Viewer' at Start and opening the Event Viewer application.

You'll see that it provides a summary of administrative events and recently viewed nodes. If you click on the Event Viewer (Local) icon in the pane on the left, a drop down menu will open. Go to Window Logs . . . Application and you should a number of recorded events indicating the time when the computer was in use. Here for the sake of security I have redacted the viewable events except for one. Note that its Event ID is 6000, which indicates that there was unsuccessful login attempt. See the note here: https://technet.microsoft.com/en-us/library/cc734033(v=ws.10).aspx

By making reference to the event IDs, you find out a lot about actions taken on a PC.

Windows 7 and other Win OSes older than Windows 2003 have event logs saved with the extension, .evtx, whereas earlier Windows systems had event logs saved with the extension, .evt.