Question: who last modified a file?
Answer: Start → Administrative tools → Local security policy snap-in.
Expand Local policy → Audit policy.
Go to Audit object access.
Select Success/Failure (as needed).
Confirm your selections and click ok.