Forensic Investigation Tools
LastActivityView Tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
LastActivityView Introduction
According to the developer websites, LastActivityView is a tool for Windows operating systems that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer. As such, it can be considered as a forensic tool for live analysis on systems. The activity displayed by LastActivityView includes: Running .exe file, Opening open/save dialog-box, Opening file/folder from Explorer or other software, software installation, system shutdown/start, application or system crash and more
You can download this tool for Windows Forensics on the link Download Page
Using LastActivityView on Windows Systems
Once you open the tool,you will see that you are able to see the activities that are running on your windows system in the foreground and background. This can be helpful in tracing incidences that could have happened on your system. The ActionTime column shows when an action occured, the description shows what action occured, the filename lists the file that ran the action. We also have the full path to the item that ran the action and a description that can show where the file originated from if it is a reputable company. Blank spaces in this "More Information" tab can be something interesting because it could mean that the program is not from a well known or reputable company. We can also see the location of the data source.
This can become a good tool to look through if you suspect malware that your antivirus is failing to catch.
I tried opening a screenshot in my folder where I am creating this tutorial and then refreshed the page to see if I could spot the action. The screenshot below shows that I opened the folder and the PNG file. You are able to see any file that is opened including executables and non-executables.
By default the tool is able to show activities that have happened in a one day period but we can extend this to some more days.
To do this, first go to Options->Advanced Options as shown below.
Check the option that says "Show only activity in the last..". You can then insert the number of days it should be able to check back.
LastActivityView is definitely one of the best tools for viewing what is happening on your system with the processes running and the files involved with certain activity.