What free tools show what happened on my Windows PC?

Already on every Windows PC. The Security log shows successful and failed sign ins, and the System log shows startups, shutdowns and some hardware events. It is the right first place to look for who signed in and when. It does not show which files were opened unless file auditing was set up beforehand, the entries are written for administrators rather than people, and an administrator can clear the logs.

A free tool from Microsoft's Sysinternals suite that writes detailed records of program starts, network connections and file creation into the Windows event log. Security teams use it widely. It needs a configuration file to be useful, has no friendly interface, and is aimed at people comfortable reading raw event data.

A small free utility from NirSoft that collects traces Windows keeps anyway, such as programs run and files opened through common dialogs, into one timeline. It is quick and needs no setup, which makes it good for a first look. It can only show what happens to be left behind, and those traces are easy to clear.

A free app from Alcyone Secure built for owners rather than administrators. It records which files were opened, which programs ran, sign ins, boots and every USB device and file copied to one, seals each entry to the one before it so changes show, and summarises the week in plain language. Before a handover, Repair Mode turns a service window into one report with a verdict.

To check sign ins after the fact, open Event Viewer. For a quick look at recent activity, try LastActivityView. If you are technical and want everything, set up Sysmon. If you want a readable, sealed record going forward, especially before handing the laptop to someone, use Rashnova. What none of them can do is recover a record of a time when nothing was recording.