Find When & Which Programs Were Running with Process History

There are many programs for Windows that can tell you which processes are currently being run on your Windows system. Windows itself comes with the Task Manager and then there is SysInternals’ Process Explorer which is more than enough to observe processes, threads and services being run on your PC. Although these programs can tell you all the details about the processes that are being run right now, but none of them can tell you about the processes that were being run in the past –  a few days ago, a few hours ago or on a specific date. This is where the free Process History comes in. The freeware Process History can record the history of all the processes that were run on your system along with their start and end time stamps.

The Process History program comes with both the 64-bit and 32-bit versions. It comes as a portable application, so you do not have to install anything on your system. You can just download the ZIP archive, extract the contents to a folder and use it from there. The first thing you would have to do is create a user. Creating a user is important, so that it can capture all the processes being run under that user’s credentials. In order to create a user, you have to launch ProcessHistory.exe and select PH → User from the menubar. It would allow you to create a user with same username as your Windows machine name and your Windows login name.

Process History

Once the user have been created, you would see a new file PH.db in the same folder. Now you can launch the Background32.exe (or Background64.exe if you downloaded 64-bit version) with administrator level privileges. This program shall monitor your system for all the running processes and log them into the database file when these processes exit. You can keep this background program running as long as you want to capture the process history on your PC.

Process History

Now at any time, you can launch ProcessHistory.exe and enter a date in the YYYY-MM-DD HH:MM format. You do not have to enter the complete date. Then click on the green right-arrow button. This would show you all the dates matching the ones you are searching from the database. Upon selection of a date-time from the list, it will show the process history for that date.

Process History

It will show the data of the process history for the selected date and time in a colorful graphic format. You can see various programs and their names in different colors. You can right-click on any of the programs and choose various options like View Process to view its details in the lower pane, Open containing folder to locate the program in Windows File Explorer, Run Selected to run that program again and more.

Conclusion: Process History is a special free tool for Windows that can keep a record of all the processes that were running on your system in past. The ability to view the history of the processes allows you to analyze which programs have been running in a particular time range.

You can download Process History from https://code.google.com/p/processhistory/.

  • Jan

    Cheers for the great review. Good to see Process History running on Windows 8!

    I’ve got some updates in development:

    – Import of Sysinternals Process Monitor csv files
    – GUI improvements e.g. jump to most recent process, mouseover, filtering on user, executable
    – More technical data for each process e.g. command line, dll host .

    • Thanks for noticing this post on our website 🙂

      While you are going to update it, I think you should also add an option to view the history using a drop-down menu populated with dates (like in Mozilla Firefox). This would make it a little easier to view the history.

      I will be glad to update this post when you release a newer version. Thanks for the comment 🙂

      • Jan

        I’ve had a few similar comments. Do you think that should replace the time line view entirely?

        • I think timeline is useful. But the way you have to enter in the date is a little difficult as it takes multiple steps. Instead a drop-down menu of available dates would make it easier.

          Also another option to search for a process name would be great too, so that you can search for “firefox.exe” in a specific date range and it will show you when firefox was running in that date range.

  • Suz H

    Any idea how to resolve this issue:

    2014-Jun-04 21:53:32 159 ..PHLoggerCOM_WMI_ConsumerPHEventConsumer.cpp 0x80041003 ExecNotificationQuery failed.

    • Jan

      Are you running it as administrator?

    • Jan

      Run background.exe elevated to administrator

  • Sure, in a few seconds 😉