Abstract: A method and system for automatically collecting and for analyzing information about time and work performed on a computer includes a hardware abstraction layer for monitoring activity on various user input devices. The system also includes the following elements: a data collector for monitoring certain portions of a user's computer activity and for logging into a log file those certain portions of a user's computer activity; a data analyzer for determining by following user-defined rules showing which portions of those certain portions of a user's computer activity constitutes continuous work activities, and how this work should be categorized by project and task with project; and an external interface for building the rules defining work. The data collector includes a resident module, such as a TSR (terminate-and-stay-resident) module, which extends the file system of the computer so that detailed records are kept of file activities.