Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Security-Basics
[Top] [All Lists]

RE: Checking when the OS was first installed

Subject: RE: Checking when the OS was first installed
Date: Tue, 24 May 2005 17:00:16 +0100
From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if that
is a worry.

There is also a registry key in
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\

Although this is a DWORD so its not exactly human-friendly!

cheers,

Andrew

-----Original Message-----
From: ricci [mailto:ricci@cs.ust.hk] 
Sent: 24 May 2005 01:08
To: security-basics@securityfocus.com
Subject: Checking when the OS was first installed

Hello All,

I was given a Windows XP Pro bootup hard disk for 
verification of its first installation date. What information 
I can verify when the hard disk was first installed?

Secondly, if the OS was cloned and reproduced from another 
source, how can I verify that? Other than Norton Ghost, what 
other tools could be used for duplicating the hard disk? 
Besides, if I got a hard disk how can I verify what software 
(for cloning) it has been used?

In a Windows XP platform, what is the use of Windows XP 
RestorePoint? What information I can collect from the 
RestorePoint? Is that related to backup information?

Thanks.

Ricci






<Prev in Thread] Current Thread [Next in Thread>