Along the same lines..... you could look at the volumes on the disk and see
if they add to the total sectors available....if they are like disks then
they ( the total in available volumes + MBR) will equal the total available
sectors on the disk. If there is unallocated space the disk may have been
duplicated onto a disk on a different size.
----- Original Message -----
From: "Hindle, Dallas" <Dallas.Hindle@bakersdelight.com.au>
To: <ricci@cs.ust.hk>; <security-basics@securityfocus.com>
Sent: Thursday, May 26, 2005 9:47 PM
Subject: RE: Checking when the OS was first installed
I don't believe there is anyway to tell if a HDD has been duplicated
with something like Ghost or other Disk imaging software. The point of
these products is to make an exact duplicate of the data on the disk.
However, you could check the serial no. on the disk or manafacture date
on the HDD and see if it sounds right for the pc's purchase date. If the
date is too old then it may have been a different disk, or if the disk
is newer than the purchase date of the pc it would also raisey
suspissions.
Dallas Hindle
Infrastructure Team Leader
Bakers Delight Holdings Limited.
Suite 1, Level 1
293 Camberwell Road
Camberwell, Victoria, 3124
Australia
p. +61 3 9811 6183
m. 0413 707 451
f. +61 3 9811 6100
w. www.BakersDelight.com.au
e. Dallas.Hindle@BakersDelight.com.au
-----Original Message-----
From: Ryan Kubiak [mailto:rkubiak@btc-bci.com]
Sent: Friday, 27 May 2005 5:28 AM
To: Andrew Aris; ricci@cs.ust.hk; security-basics@securityfocus.com
Subject: RE: Checking when the OS was first installed
Any repair of the Windows installation will change the date in
systeminfo,
and I'm fairly sure the registry key as well. There is no easy way to
determine the original install date if someone is trying to hide that
information from you that I know of.
Ryan
-----Original Message-----
From: Andrew Aris [mailto:andrew@dev.bigfishinternet.co.uk]
Sent: Tuesday, May 24, 2005 12:00 PM
To: ricci@cs.ust.hk; security-basics@securityfocus.com
Subject: RE: Checking when the OS was first installed
From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if
that
is a worry.
There is also a registry key in
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\
Although this is a DWORD so its not exactly human-friendly!
cheers,
Andrew
-----Original Message-----
From: ricci [mailto:ricci@cs.ust.hk]
Sent: 24 May 2005 01:08
To: security-basics@securityfocus.com
Subject: Checking when the OS was first installed
Hello All,
I was given a Windows XP Pro bootup hard disk for
verification of its first installation date. What information
I can verify when the hard disk was first installed?
Secondly, if the OS was cloned and reproduced from another
source, how can I verify that? Other than Norton Ghost, what
other tools could be used for duplicating the hard disk?
Besides, if I got a hard disk how can I verify what software
(for cloning) it has been used?
In a Windows XP platform, what is the use of Windows XP
RestorePoint? What information I can collect from the
RestorePoint? Is that related to backup information?
Thanks.
Ricci
--
Message protected by MailGuard: e-mail anti-virus, anti-spam and content
filtering.
http://www.mailguard.com.au/mg
