Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Windows 10 does not keep a single, complete “computer history.” Different records are stored in Timeline/Activity history, your browser, File Explorer, Event Viewer, applications and PowerShell. Choose the source that matches what you need to find: opened files, visited sites, sign-ins, startup events or commands.
Important: Windows 10 reached end of support on October 14, 2025. These steps describe Windows 10, but labels can vary by build, edition, browser and installed updates.
Choose the right history tool
| What you want to know | Where to look |
|---|---|
| Apps, documents and recorded activities | Timeline (Task View) and Activity history |
| Websites visited | The browser’s History page |
| Recently opened files and folders | Quick access, shell:recent and the application’s Recent list |
| Successful or failed sign-ins | Event Viewer → Windows Logs → Security |
| Startup, shutdowns, crashes and services | Event Viewer → Windows Logs → System |
| PowerShell commands | Get-History and the PSReadLine history file |
| Windows troubleshooters that ran | Settings → Update & Security → Troubleshoot → View troubleshooting history |
No source proves every action a person took. Records can be disabled, deleted, overwritten, limited to one account or created on another computer.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →1. Check Timeline and Activity history
Timeline displays recorded activities such as documents and applications. Press Windows+Tab, or select the Task View button on the taskbar. Browse the cards by date and use the search box when available. Select a card to reopen its associated item.
#1 Best Overall
To remove an activity, right-click its card and choose Remove. To clear a day, right-click an activity and choose the applicable Clear all from… command.
To review or clear stored activity data, open Start → Settings → Privacy → Activity history. Check Store my activity history on this device (shown as a checkbox on some builds), and review which local, Microsoft, work or school accounts are included under Show activities from these accounts. Select Clear to remove locally stored activity history. See Microsoft’s Timeline guide and Activity history privacy information.
Timeline is not an audit trail. It may be empty or incomplete when activity storage was disabled, an application did not integrate with Timeline, an account is filtered out, records were cleared, a browser was used privately, or a file was moved, deleted or stored on another device. Windows 10 version 22H2 also deprecated sending activity history to Microsoft in an update released January 23, 2024; older builds can show different controls.
2. Check browser history
Website history normally belongs to the browser, not a central Windows screen.
Microsoft Edge
- Open Edge and press Ctrl+H.
- Search or browse entries by date.
- Use the page menu to delete individual entries or selected time ranges.
Chrome and Firefox also open History with Ctrl+H. Check each browser profile separately. InPrivate, private or incognito windows are designed not to retain normal local browsing history. Deletion, profile resets, synchronization and use of another device can also change what you see. Microsoft documents Edge data handling in its browsing-data and privacy guide.
Rank #2
- Overview of computer forensics: This could include an introduction to the field of computer forensics, including its history, goals, and methods.
- Cybercrime investigation: The book might cover different types of cybercrimes, such as cyberbullying, identity theft, and online fraud, and discuss how computer forensics can be used to investigate and prosecute these crimes.
- Legal considerations: The book could delve into the legal aspects of computer forensics, including the laws and regulations governing digital evidence, as well as the ethical considerations involved in collecting and analyzing digital data.
- Evidence collection and analysis: The book might provide detailed information on how to properly collect, preserve, and analyze digital evidence, including techniques for recovering deleted or hidden data.
- Case studies and real-world examples: The book might include examples and case studies of actual computer forensic investigations to illustrate key concepts and techniques.
A history entry indicates that a URL was opened or recorded; it does not prove who was at the keyboard, that the page was read, that a download completed or how long it was viewed.
3. Find recently opened files and folders
File Explorer
Open File Explorer and select Quick access. Review recent files and frequently used folders if those features are enabled.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Recent Items folder
Press Windows+R, enter shell:recent, and press Enter. Windows opens the current user’s Recent Items shortcuts when they exist.
Application lists
Programs often keep their own records. In Word or Excel, use File → Open → Recent. Media players, image editors and PDF readers may have similar Recent or Recently played lists.
These are convenience lists, not forensic records. They can be cleared or disabled and usually apply only to one user profile. Files opened from network shares, removable drives, cloud storage or temporary locations may not appear reliably.
4. Check sign-ins and failed logons in Event Viewer
- Press Windows+R, type
eventvwr.msc, and press Enter. - Expand Windows Logs and select Security.
- Select Filter Current Log….
- Filter for event ID 4624 (successful logon) and 4625 (failed logon).
- Open an event to inspect its timestamp, account, logon type and available workstation or network information.
Common logon types help interpret the result: interactive means a local console sign-in; remote interactive generally indicates Remote Desktop; network indicates access to a shared resource; service or batch can represent a service or scheduled task; unlock means an existing session was unlocked. Microsoft’s Audit Logon documentation explains the policy that generates these events.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →“No event found” does not mean “no one used the computer.” Auditing may not have been enabled, the Security log may have been cleared or overwritten, the event may exist on another machine (such as a server), or your account may lack permission to read it. A logon event records an authentication event and account data, not guaranteed physical identity.
5. Review startup, shutdown and system activity
In Event Viewer, open Windows Logs → System, choose Filter Current Log…, and inspect the relevant date and time. Search for providers or descriptions such as Kernel-General, Kernel-Boot, EventLog, unexpected shutdowns, and service starts or failures.
The System log is useful for troubleshooting, not a perfect record of every power-on or user action. Hard power loss, corrupted logs, incorrect clocks and log rollover can create gaps.
6. Check PowerShell command history
In the PowerShell window of interest, run:
Get-History
Get-History -Count 20
Get-History | Format-List -Property *Get-History normally returns commands from the current session. Windows PowerShell 3.0 and later default to a maximum of 4,096 session entries, subject to configuration. It does not automatically show every command ever run.
PSReadLine can keep a persistent, host-specific history after a session ends. A usual Windows PowerShell path is:
$env:APPDATAMicrosoftWindowsPowerShellPSReadLineConsoleHost_history.txtThe filename and location can differ for PowerShell 7, Windows Terminal and other hosts. History may be missing when commands were run in Command Prompt, PSReadLine was disabled, the history was cleared, a different host was used, or a script, paste, service or scheduled task executed the command.
7. Use PowerShell to query and export Windows logs
For a repeatable review, open PowerShell and run:
Get-WinEvent -ListLog *
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 4624,4625
} -MaxEvents 100
Get-WinEvent -LogName System -MaxEvents 100To save recent logon events as a CSV on the desktop:
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 4624,4625
} -MaxEvents 100 |
Export-Csv "$env:USERPROFILEDesktoplogon-history.csv" -NoTypeInformationGet-WinEvent supports filtering by log, event ID, XML and XPath. Some logs require an elevated PowerShell window.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors8. Check troubleshooting history
Windows 10 records runs of some troubleshooters separately. Open Start → Settings → Update & Security → Troubleshoot → View troubleshooting history. This is a record of Windows troubleshooting tools, not a general report of everything done on the computer. Microsoft documents the path in its Windows Logon troubleshooter guidance.
When history is missing
| Symptom | Likely explanation | Next step |
|---|---|---|
| Timeline is empty | Storage was disabled, an account is filtered, the app is unsupported or records were cleared | Check Activity history, then the browser, application Recent list and Event Viewer |
| Browser entries are absent | Private mode, deletion, another profile, sync changes or another device | Check all profiles and the browser’s synced data |
| No sign-in events | Auditing was disabled, the wrong log was selected, records rolled over or activity occurred elsewhere | Check policy, date/time settings and other computers |
| PowerShell history is absent | The session ended, another host was used or history was cleared | Run Get-History and inspect the relevant PSReadLine file |
| Older records are unavailable | Retention limits, clearing or log overwrite | Look for prior exports, backups or centralized logs |
Windows’ ordinary history features cannot reconstruct deleted or never-recorded activity reliably. For future incident response, organizations should enable appropriate auditing, retain and centralize logs, and follow a documented policy rather than relying on Timeline.
Privacy, consent and preserving records
Reviewing another person’s browser, account or command history can violate privacy expectations, workplace or school rules, or local law. Use transparent policies and appropriate consent; do not bypass passwords, defeat encryption or secretly install monitoring software.
If you are investigating an incident, export or preserve relevant logs before clearing anything. Clearing one source does not necessarily remove copies in browser synchronization, backups, application logs, event exports or other devices. Timestamps are recorded computer time and can be affected by the clock, time zone, synchronization and daylight-saving settings.
Finally, checking history does not make Windows 10 secure. Since support ended on October 14, 2025, plan migration to a supported Windows release or use an applicable, explicitly administered extended-support arrangement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
