Show historic hardware changes in windows 7

3

Brief question: In Windows 7, Is there a log where I can see the ram memory of the system at different dates?

Explanation:

A friend of mine have detected some missing hardware (ram sticks) on some new computers, just after weeks of buying them. They need to know the exact date the ram stick was removed/changed, in order to check at the security cameras. But they do not know how to get that info, if it exists at all.

I have been trying to help him by looking for related info (although I do not use Windows so I am not familiar with it). I have found something called event manager, which store the logs on the system. But I was unable to find the specific hardware info. So, is there a way to know at least the ram detected by the operating system at several dates?

I have checked https://serverfault.com/questions/209505/windows-server-hardware-change-log , but they use windows server (my friend's office use a regular copy of windows 7, whose specific version I do not know)

Thanks in advance.

iluvatar

Posted 2015-04-28T23:32:39.343

Reputation: 131

I wouldnt know, but there are some rare softwares that will store minor system specs on each run into thier own log (can include avail ram). There is the hardware "hash" by which the MS activation and licence system uses which could have changed (but not enough changes to require re-activation) There is the customer experience program sending out anon data on shedule, and memory diagnositcs which occur on shedule, IF any of that was on. soo one thing, Go through the "Task Schedule" items for clues to finding logs that may be useful, Search for *logs and weed though them for any clues. – Psycogeek – 2015-04-29T03:41:33.047

Answers

1

I'd look to see when the system was restarted or powered up. Search the Event Viewer under System Log for EventID 6009 (one of the events that hits when a system is first started up) and then review the cameras around that time. Should be obvious if anyone tampered with the case. You can also refer to the manuf info about bios intrusion detection. Some BIOS keep track of it and the log can be reviewed. It won't show RAM differences, but should be helpful to track it down along with security cameras.

MikeAWood

Posted 2015-04-28T23:32:39.343

Reputation: 647

The problem seems to be that they turn off all computers every night (some kind of energy saving policy) and then turn on again at morning. Therefore the log is flooded with event 6009. But the BIOS suggestion could be the way. I will check it tomorrow. Thanks. – iluvatar – 2015-04-29T02:19:51.197