Document Auditing?

Hello Yet Again,

A customer of mine has an XP HE desktop computer. One version, am not sure
which one, probably 2000, of the MS Office suite is installed.

She tells me that there was an internal (i.e., employee, someone's
signifigant other, etc.) breach a few months ago; she would like to know if
there is any way to check the dates and times that particular Word documents
and Excel spreadsheets had been accessed.

I know that document auditing software exists, and how to find it. But my
question to y'all is: is this something that you've ever had to use, and,
does the auditing program have to be installed, first, or can it an audit be
conducted after the fact? Is there anything that you can recommend? I'm
curious about this one

http://www.bystorm.com/FileSureAudit.aspx?_kk=file auditing&_kt=e43d4e73-e98e-490a-989a-a2320e3d43e8 .

I am working under the assumption that the password to the computer itself
was known to the individual, or that the computer was already logged into.
So, I'm not looking for an "access denied" message, am looking find out,
probably in log file form, the history of these particular files, when they
were created, accessed, written to, etc.

Any insights would be very much appreciated.

Thanks in advance,

smackedass

 

<snip>

An update to XP Pro (assuming XP HE stands for XP Home Edition) might be
easier and cheaper in the long run - it has auditing built in, for both
successful and unsuccessful attempts of opening files/folders.

http://support.microsoft.com/kb/310399

Auditing after the fact is unlikely, if not impossible.