1
Programs & Features (or even better Nirsoft's MyUninstaller) tell me the program installed, and I can accessed some cached installation data, but is there a way to get a log of the executables that were ran by a user?
setup.exe's (usally?) contain msi info, but I'm looking for a list of the setup.exe's ran by the user.
I'm trying to work out the executable (filename, and path ideally) that was ran that installed a program, to backup the installer.
I have date/time created (15/05/2015), and using the epic 'Everything' search tool (from Void) I can see files accessed on that date (using da:15/05/2015 *.exe) but I can't see anything that sticks out, which makes me think the installers already been trashed... is there a log anywhere?
for example, I see some huge installers like 30475b.msi in C:\Windows\Installer I can open the .msi and see what's in them I guess - is there any log anywhere that records a correlation between these ubiquitous .msi files and their originating 'container executable'?
Wondering (if not), if any search tools can search inside executables for source.msi etc