Can I prove that someone used an executable that connected to the Internet (not necessary a harmful one) on my Windows 10 PC? Especially when the program was installed on a removable device such as a USB stick and not on the PC itself?

The only thing that came to mind was the Windows Event Log. But, as far as I know (and tested) programs only write to it if there is some kind of error, or if you let some code write to the log.


Is there a way to prove that a program was executed on my Windows PC?

Regarding program execution: Some programs will copy themselves to a temporary directory on the Windows machine when executed from a USB stick, you could look for a program with the same name in temporary files directory on the computer of interest. You can also look at Windows Registry keys associated with recently executed programs such as "shell\bagMRU." You could also look for "prefetch" files associated with the program being executed.


With a network capture or proxy server log, otherwise I don't believe so.

  • A server log would require adminstraive rights for the network/gateway that is used to connect to the Internet I guess? When connect to an open network this won't be possible?!
    – Gistiv
    Aug 6 '18 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.