NTFS drives use a Master File Table (MFT) to hold every detail of your files: size, location, creation and modified dates and more.

The MFT is regularly used by applications which need extra information about your files, like undelete tools, but grab a copy of Mft2Csv and you can also use this data. For example, it's a great way to get a timeline of the files created on your hard drive, possibly going back years.

The program has a vast number of options, but if you simply want to scan your main system drive then fortunately they can all be ignored. Launch it, make sure your volume is displayed, and hit Start Processing (or use Mft2Csv /volume:c: from the command line).

Mft2Csv then processes your entire MFT, and begins exporting it to a CSV file. This can take an extremely long time - an hour or more, depending on your drive size, age and system speed - so it's best just to walk away and leave it to work.

The completed CSV displays an entry for every file, along with all the related NTFS information. Most of this is too low-level and technical for even expert users to care about, but there's the file name, size, attributes, creation, access and modified times, and more (there's an explanation of some fields here).

Now all you have to do is sort your CSV by the CTime field (Creation Time) and the list becomes a timeline, showing which files were created, and when. This includes deleted files, too, as long as their MFT entry hasn't been overwritten, so it's at least possible that you may have activity records stretching back years.