Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

How to pull an email address from harddrive, cookies, web hi

Oct 24, 2012 2:53PM PDT

So I'd like to be able to identify an email or user name for an email that was logged into from my personal PC. I do NOT need to access the email, only tell who logged in. The web history was erased so I've done a few things
1. tried to restore but didn't have a restore point that worked.
2. downloaded an index.dat reader program
-Found the transactions and identified it as a hotmail account
-found the exact time frame from the date stamps
3. downloaded a File Scavenger program to see if what i was looking for was deleted, no luck


I'm out of ideas and would really like to find out who logged into my computer. Thanks for your help!

Discussion is locked

- Collapse -
Answer
Not a sure thing.
Nov 1, 2012 6:01AM PDT

At the office if we suspect such we plug it a key ghost device. It's pretty amazing.

http://en.wikipedia.org/wiki/Hardware_keylogger

But as you suspect, after the fact is rarely recovered. Even more so if the machine is allowed to be used after the event.
Bob

- Collapse -
Answer
Assuming that ...
Nov 1, 2012 1:38PM PDT

the system was either shut down and the user in question had to boot and logon or the screen was locked and the user had to logon (as opposed to simply sitting down at a running logged on session) since you know the "exact time frame" you should be able to locate the user name by looking in your SECURITY log with your Event Viewer.

This assumes you are using Windows NT or newer and that the computer wasn't left unsecured where anyone could make use of a currently running session AND that the user didn't logon using the Guest account (which would only indicate a guest logged on).