Reset Windows Password: Camera and microphone access tracking
Using this forensic investigation feature you can figure out easily what program or process was using the microphone or camera (as well as some additional devices like location sensors, if Windows stores the history), when and how long was the last activity session.
Windows stores the tracking information in the following registry keys:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam
This tool can also be used to detect a rat-like behavior of any malicious processes or programs accessing the hardware secretly.
Choosing user account
![Hardware access tracking - selecting user account Selecting user account for extracting hardware access tracking information](/images/camera_microphone_user.png)
In order to extract the camera\microphone tracking information, you need to choose a user account first.
Date and time filters
![Hardware access tracking - setting date and time filter Sorting out unnecessary information](/images/camera_microphone_time.png)
You use the time filters to display a certain date or period only.
Camera and microphone access tracking
![Camera and microphone access tracking Displaying camera and microphone access tracking information](/images/camera_microphone_tracking.png)
Where appropriate, the program retrieves access information for any available hardware, like Bluetooth devices, not just the microphone or camera.