Back to Process History download & source.

Contents

Making a query
Requirements

The background logger 

Create a user account from the PH menu | User... in Process History. This means that PH will now log your processes when it is running. You can delete your user the same way.

background.exe should be started and left running for the period that you want to record process usage. Only processes ending whilst PH is running will be captured. Only one instance of background.exe must be run at a time.

NB: background.exe needs to be run as administrator. Error 0x80041003 will be found in PHTrace.txt log if not run as administrator

Making a Query

Run ProcessHistory.exe

The viewer shows you a blank white window when it is started.

Enter the date and time in the field on the tool bar to search for processes. If no processes were logged at that time PH try a broader query - see video.
The time must be in the format YYYY-MM-DD HH:MM ( 24 hour clock )
Preceding zeros for one digit numbers e.g. 13:01 for one minute and one second past 1 pm.

If you are unsure of the exact time: Enter a year, press return or click the query button and select a result in the drop down list, and repeat with the month and day. As shown in this video:

Content on this page requires a newer version of Adobe Flash Player.

Get Adobe Flash player

Click the Query button on the toolbar to display the results.

Date and time results.

Right click on a processes that results from the query to get the following options on the context menu.

- Select View ... to view the process. Information displayed is Path, (total) duration, begin and end times, user and whether this is a 32/64bit executable.
A CRC (Cyclic Redundancy Check) of the executable is shown from the time that it executed
. This is a unique summarisation of the executable that is useful for tracking when changes occur.
- Click Run selected to run the executable of the process.
- Open containing folder to navigate to the executable in the file system.
- Click goto begin/ goto end to navigate to the start/end of the process.

Press the left/right buttons on the toolbar to navigate back or forward to the previous/later processes have been recorded.

A key is available on the PH Menu.

Requirements

PH is tested on the following operating system: 32 bit Windows XP SP3, 64 bit Windows 7 SP1, 64bit Windows 10

PH will continue to support being run on Windows XP SP3 after Microsofts official end of support in April 2014

The 64 bit logger will log both 32 bit & 64 bit processes and will only run on 64bit Windows. The 32 bit logger will log only 32 bit processes running on 32 & 64 bit windows.


Need more help, please leave a comment below