ExecutedProgramsList is a tiny portable tool which lists programs and batch files previously launched on a PC.

For every program, ExecutedProgramsList displays the .exe file name, product name, version, description, and - sometimes - when it was last executed.

This is great if you need to check what someone is doing on a computer. Take ExecutedProgramsList to the system on a USB key, run it, and wait for the results (we found they can take a long time to assemble, so be patient). When the report appears, either browse the executable file names, or click the "Last Executed" column header to sort by execution order, allowing you to see what was run when.

The program is more reliable than some similar tools as it assembles its data from multiple sources, including the Windows Prefetch folder and four Registry keys: HKCU\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache, HKCU\Microsoft\Windows\ShellNoRoam\MUICache, HKCU\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted, HKCU\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store.

However, it's still not infallible, and while you might find references to something you ran months ago, it's also possible ExecutedProgramsList might miss something you ran yesterday. Treat it as an indication only.

Version 1.11:

  • Added 'Auto Size Columns On Load' option.
  • Added 'File Properties' option. (Open the Explorer properties window of the .exe file)

Verdict ratingsratingsratingsratingsratings

A handy forensic tool which tells you more about how a PC is being used