Back to Process History download & source.


Making a query

Logging processes 

ProcessHistory.exe can be started and left running for the period that you want to record process usage. Only processes ending whilst PH is running will be captured.

NB: ProcessHistory.exe needs to be run as administrator to monitor all processes.

Making a Query

The viewer shows you a blank white window when it is started.

Enter the date and time in the field on the tool bar to search for processes.
The time must be in the format YYYY-MM-DD HH:MM ( 24 hour clock )
Preceding zeros for one digit numbers e.g. 13:01 for one minute and one second past 1 pm.

You can enter a year, press return or click the query button and select a result in the drop down list, or month or day.

Click the Query button on the toolbar to display the results.
To limit the results across any time period by executable. Click File | Executable... or click the button on the toolbar or enter an executable path in the adjacent field. If you wish to remove the filter clear the text in the field on the toolbar
To limit the results by user across any time period select the user from the drop down list

Date and time results.

Right click on a processes that results from the query to get the following options on the context menu.

- Select View ... to view the process. Information displayed is Path, duration, begin and end times, command line, user and whether this is a 32/64bit executable.
A CRC (Cyclic Redundancy Check) of the executable is shown from the time that it executed
. This is a unique summarisation of the executable.
This information is also available when the mouse pointer is over the process. It can be copied to the clipboard by right clicking.
- Click Run selected to run the executable of the process.
- Click Run with command line to run the executable of the process with the command line it was run with.
- Open containing folder to navigate to the executable in the file system.
- Click goto begin/ goto end to navigate to the start/end of the process.
- Click Set Executable Filter to limit the results by processes executable
- Click Set User Filter to limit the results by this processes user

Press left or right arrow on the keyboard, or the left/right buttons on the toolbar to navigate back or forward to the previous/later processes have been recorded. If there is a gap between the recorded processes PH will find the processes after the gap. Press ->| on the toolbar to go to the most recently recorded processes.
Double click on the third pane of the status bar to toggle between ALL processes or those BEGINning/ENDing in the time period

A key is available on the PH Menu.


PH is tested on the following operating system: 32 bit Windows XP SP3, 64 bit Windows 7 SP1, 64bit Windows 10

PH will continue to support being run on Windows XP SP3 after Microsofts official end of support in April 2014

The 64 bit logger will log both 32 bit & 64 bit processes and will only run on 64bit Windows. The 32 bit logger will log only 32 bit processes running on 32 & 64 bit windows.

Need more help, please leave a comment below