NirSoft’s user-tracking LastActivityView now displays all the recent wireless network connects and disconnects for the current system.

This is particularly handy for computer forensics, as it might help show where a laptop user has been over the past few days.

The program also records many other user actions, including EXE file launches, files opened and saved, software installed, application or system crashes, system close and startup times, and more.

The Actions list is initially ordered by time, although you can also sort by field to group common actions together (browse all files opened in one list, for instance).

LastActivityView’s advantage is that it doesn’t log this information itself, rather it assembles the data from Windows event logs and other sources. As a result, you don’t need to install it on a system or have it running on the background– just launch the program once and it’ll build a timeline of whatever information is available.

See recently-launched programs, opened files and folders, shutdown and startup times, installations and more

If you want to protect your system from this kind of snooping, you could try disabling the necessary event logs.

For example, to stop Windows logging your wireless network connects/ disconnects, launch Event Viewer, and go to Applications and Services Logs > Microsoft > Windows > WLAN-AutoConfig. Expand that log in the left-hand pane, right-click Operational, select Clear Log, right-click again and select Disable Log.

LastActivityView runs on Windows 2000 and later, although some features require later versions (wireless network connects aren’t logged until Windows Vista).