The date of the boot.ini file or the winnt folder (%systemroot%) may help you.
Christophe
-----Original Message-----
From: Ryan Kubiak [mailto:rkubiak@btc-bci.com]
Sent: Thursday, May 26, 2005 3:28 PM
To: Andrew Aris; ricci@cs.ust.hk; security-basics@securityfocus.com
Subject: RE: Checking when the OS was first installed
Any repair of the Windows installation will change the date in systeminfo,
and I'm fairly sure the registry key as well. There is no easy way to
determine the original install date if someone is trying to hide that
information from you that I know of.
Ryan
-----Original Message-----
From: Andrew Aris [mailto:andrew@dev.bigfishinternet.co.uk]
Sent: Tuesday, May 24, 2005 12:00 PM
To: ricci@cs.ust.hk; security-basics@securityfocus.com
Subject: RE: Checking when the OS was first installed
From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if that
is a worry.
There is also a registry key in
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\
Although this is a DWORD so its not exactly human-friendly!
cheers,
Andrew
-----Original Message-----
From: ricci [mailto:ricci@cs.ust.hk]
Sent: 24 May 2005 01:08
To: security-basics@securityfocus.com
Subject: Checking when the OS was first installed
Hello All,
I was given a Windows XP Pro bootup hard disk for
verification of its first installation date. What information
I can verify when the hard disk was first installed?
Secondly, if the OS was cloned and reproduced from another
source, how can I verify that? Other than Norton Ghost, what
other tools could be used for duplicating the hard disk?
Besides, if I got a hard disk how can I verify what software
(for cloning) it has been used?
In a Windows XP platform, what is the use of Windows XP
RestorePoint? What information I can collect from the
RestorePoint? Is that related to backup information?
Thanks.
Ricci
