How can I view the last action in Win 11 before undoing, i.e. see what action that was?

Donk · Feb 1, 2024

How can I view the last action in Win 11 version 23H2 before undoing, i.e. see what action that was?

I accidentally pressed a key and apparently triggered some kind of action, but I don't know what. A small window appeared briefly in which was shown that something was probably copied/moved or something like that.

Or is there another way how to find out what happened?

x BlueRobot · Feb 1, 2024

Hmm, its going to be quite difficult to determine without knowing exactly what kind of notification you had, however, have you checked the Event Logs for any events around the date or time you triggered the action?

You could try using AppCompatCacheParser to see what was executed, can't guarantee how useful it will be though.

From an elevated command prompt:

Code:

AppCompatCacheParser.exe --csv %userprofile%\Desktop -t -c 1

Download: MDwiki

Donk · Feb 1, 2024

Hmm, its going to be quite difficult to determine without knowing exactly what kind of notification you had

Yes, exactly, If I knew exactly what kind of notification it was, I would know what action it would have been.

have you checked the Event Logs for any events around the date or time you triggered the action?

No, what's the best way to do that? Which log should you look at? How could I open it?

Many thanks for the code. After entering it

and pressing ENTER it says:

The command "AppCompatCacheParser.exe" is either misspelled or
could not be found.

What could be wrong?

Ghot · Feb 1, 2024

Donk said:
Yes, exactly, If I knew exactly what kind of notification it was, I would know what action it would have been.

No, what's the best way to do that? Which log should you look at? How could I open it?

Many thanks for the code. After entering it

and pressing ENTER it says:

What could be wrong?

Did you download... AppCompatCacheParser from the link he supplied?

Donk · Feb 1, 2024

Sorry, no, didn't even notice the link / context / know I had to do it.

Donk · Feb 1, 2024

What do I have to do with AppCompatCacheParser.exe / with the download?

x BlueRobot · Feb 1, 2024

Donk said:
No, what's the best way to do that? Which log should you look at? How could I open it?

I would suggest checking the Application and System ones, probably best to start with the System one, you can filter the events to particular dates etc.

Rich (BB code):

wevtutil epl Application %userprofile%\Desktop\application.evtx
wevtutil epl System %userprofile%\Desktop\system.evtx

Those two commands from an elevated command prompt will export the logs to your Desktop for you, could you please also .zip them and then attach them to your next post?

Donk said:
What could be wrong?

Please download the suggested tool, and then go to the directory you saved it to, for example, if you saved it to your Desktop or Downloads folder, then unzip the .zip file and then open a command prompt from that directory. You can usually just type cmd in the File Explorer address bar and press Enter.

You should see Command Prompt open and set to that location. You can then enter:

Code:

AppCompatCacheParser.exe --csv %userprofile%\Desktop -t -c 1

The tool should then save a .csv file to your Desktop.

Here's the command-line arguments:

GitHub - EricZimmerman/AppCompatCacheParser: AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10

AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10 - GitHub - EricZimmerman/AppCompatCacheParser: AppCompatCache (shimcache) parser. Supports Windows 7...

github.com

If you're curious as to why we're using it: Amcache and Shimcache in forensic analysis

Ghot · Feb 1, 2024

@x BlueRobot

I did download it. Put it on the desktop and ran your command... didn't work.
Put it in the System32 folder, and ran the command again, and got this...

To me, the result is mostly useless, but I have the feeling it makes sense to you.

x BlueRobot · Feb 1, 2024

Thanks, it looks like the command-line parameter isn't correct, looks like it should be --c.

Code:

C:\Users\bsodt\Downloads\AppCompatCacheParser>AppCompatCacheParser.exe --csv %userprofile%\Desktop -t --c 1
AppCompatCache Parser version 1.5.0.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/AppCompatCacheParser

Command line: --csv C:\Users\bsodt\Desktop -t --c 1

Warning: Administrator privileges not found!

Processing hive 'Live Registry'

Found 529 cache entries for Windows10C_11 in ControlSet001

Results saved to 'C:\Users\bsodt\Desktop\20240201100244_Windows10C_11_LAPTOP-BS8LUFFE_AppCompatCache.csv'

Ghot · Feb 1, 2024

@Donk

Download the AppCompatCacheParser
Unzip it, and put AppCompatCacheParser.exe in your System32 folder.
Then run this command... AppCompatCacheParser.exe --csv %userprofile%\Desktop -t --c 1
Then "attach" the csv file it creates on your desktop... to your post.

In my best robot voice: "Translation complete".

@x BlueRobot

Do you dream in Command Line Interface?

I just used Winaero Tweaker to ADD elevated command prompt and elevated powershell to my right click context menus.

Both of these work in Win 10 and Win 11...

Add Command Prompt As Administrator Context Menu in Windows 10

The command prompt in Windows 10 is the shell environment where you can run text-based console tools and utilities by typing commands. Its UI is very

winaero.com

Add PowerShell As Administrator Context Menu in Windows 10

You can add Open PowerShell here as administrator to the context menu in Windows 10 to quickly open a new elevated instance of PowerShell.

winaero.com

x BlueRobot · Feb 1, 2024

Ghot said:
Do you dream in Command Line Interface?

I just find it so much easier sometimes

Donk · Feb 1, 2024

I would suggest checking the Application and System ones, probably best to start with the System one, you can filter the events to particular dates etc.

The time when the unknown event occurred was approximately 9:50 a.m. to 10:05 a.m. (I should have noted the exact time, that would have been pretty clever).

Nothing shown here, I guess:

Obviously even events in the future are listed?

Those two commands from an elevated command prompt will export the logs to your Desktop for you, could you please also .zip them and then attach them to your next post?

Done successfully. How could I view their content before uploading?

Ah OK, sorry, must be in the same directory the exe. So double clicking it was pointless.

You should see Command Prompt open and set to that location. You can then enter:

Code:

AppCompatCacheParser.exe --csv %userprofile%\Desktop -t -c 1

This is shown:

Means something like:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Migrating from Windows PowerShell 5.1 to PowerShell 7 - PowerShell

Warning: PowerShell has detected that you may be using screen reader and has disabled PSReadLine for compatibility purposes. If you want to re-enable it, run “Import-Module PSReadLine”.

PS I:\Downloads\AppCompatCacheParser> I:\Downloads\AppCompatCacheParser^Z
I:\Downloads\AppCompatCacheParser⸮ : The naming "I:\Downloads\AppCompatCacheParser⸮" was not used as the name of a
Cmdlet, function, script file, or executable program detected. Check the spelling
the name, or whether the path is correct (if included), and repeat the process.
In line:1 character:1
+ I:\Downloads\AppCompatCacheParser⸮
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (I:\Downloads\AppCompatCacheParser⸮:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

PS I:\Downloads\AppCompatCacheParser> AppCompatCacheParser.exe --csv %userprofile%\Desktop -t -c 1
AppCompatCacheParser.exe : The naming "AppCompatCacheParser.exe" was not used as the name of a cmdlet, function,
a script file or an executable program. Check the spelling of the name, or whether the
Path is correct (if included) and repeat the process.
In line:1 character:1
+ AppCompatCacheParser.exe --csv %userprofile%\Desktop -t -c 1
+ ~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (AppCompatCacheParser.exe:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

Suggestion [3,General]: The AppCompatCacheParser.exe command was not found. However, it is present at the current location. Windows PowerShell does not load commands from the current location by default. If you trust this command, type ".\AppCompatCacheParser.exe" instead. For more information, see get-help about_Command_Precedence.
PS I:\Downloads\AppCompatCacheParser>

Here's the command-line arguments:

github.com
GitHub - EricZimmerman/AppCompatCacheParser: AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10
AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10 - GitHub - EricZimmerman/AppCompatCacheParser: AppCompatCache (shimcache) parser. Supports Windows 7...
github.com

Many thanks. But sorry, I do not have any idea of computers, codes, programs and everything. Or is there anything I should to there?

If you're curious as to why we're using it: Amcache and Shimcache in forensic analysis

OK, thank you.

Ghot · Feb 1, 2024

x BlueRobot said:
I just find it so much easier sometimes

I understand the "directions" robots give, but the CLI is pretty much all Greek to me.

Ghot · Feb 1, 2024

@Donk

That's Powershell, not Command prompt.
Just follow these four steps...

Download the AppCompatCacheParser
Unzip it, and put AppCompatCacheParser.exe in your System32 folder.
Then open an elevated Command Prompt and run this command...
AppCompatCacheParser.exe --csv %userprofile%\Desktop -t --c 1

Then "attach" the csv file it creates on your desktop... to your post.

Donk · Feb 1, 2024

That's Powershell, not Command prompt.

Didn't know how to change the directory in that CMD. So I opened in the Explorer context menu an item the looked like it was the correct one.

Yes, that's actually exactly what I think I did. I tried two times.

Download the AppCompatCacheParser
Unzip it, and put AppCompatCacheParser.exe in your System32 folder.
Then run this command... AppCompatCacheParser.exe --csv %userprofile%\Desktop -t --c 1

Same error message like above with elevated CMD:

The command "AppCompatCacheParser.exe" is either misspelled or
could not be found.

Ghot · Feb 1, 2024

Donk said:
Didn't know how to change the directory in that CMD. So I opened in the Explorer context menu an item the looked like it was the correct one.

Yes, that's actually exactly what I think I did. I tried two times.

You did everything correctly, except you used the wrong command...

Use this one. Copy and paste it in the Command prompt window....
This one has TWO dashes in front of the "c"

AppCompatCacheParser.exe --csv %userprofile%\Desktop -t --c 1

Donk · Feb 1, 2024

Use this one, copy and paste it in the Command prompt window....

AppCompatCacheParser.exe --csv %userprofile%\Desktop -t --c 1

OK, thank you. But I really cannot get this to work, unfortunately, no matter how often I use/enter this command, very sorry:

You did everything correctly, except you used the wrong command...

What is / was wrong, looks like the same one here?

Ghot · Feb 1, 2024

Donk said:
OK, thank you. But I really cannot get this to work, unfortunately, no matter how often I use/enter this command, very sorry:

Did you put AppCompatCacheParser.exe in your C:\Windows\System32 folder, first?

Donk · Feb 1, 2024

Yes, I did. Did you see the screenshot?

Ghot · Feb 1, 2024

Donk said:
Yes, I did. Did you see the screenshot?

Maybe it's a language thing?

I don't know. All I can say is that it worked fine for me.
This is the result I got, and it created the CSV file on my desktop as well...