RE: Checking when the OS was first installed

["Lubrano di Ciccone, Christophe (DEF)" <diciccone () ppg com>]

The date of the boot.ini file or the winnt folder (%systemroot%) may help you.
Christophe

-----Original Message-----
From: Ryan Kubiak [mailto:rkubiak () btc-bci com]
Sent: Thursday, May 26, 2005 3:28 PM
To: Andrew Aris; ricci () cs ust hk; security-basics () securityfocus com
Subject: RE: Checking when the OS was first installed


Any repair of the Windows installation will change the date in systeminfo,
and I'm fairly sure the registry key as well.  There is no easy way to
determine the original install date if someone is trying to hide that
information from you that I know of.

Ryan

-----Original Message-----
From: Andrew Aris [mailto:andrew () dev bigfishinternet co uk]
Sent: Tuesday, May 24, 2005 12:00 PM
To: ricci () cs ust hk; security-basics () securityfocus com
Subject: RE: Checking when the OS was first installed


> From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if that
is a worry.

There is also a registry key in
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\

Although this is a DWORD so its not exactly human-friendly!

cheers,

Andrew

> -----Original Message-----
> From: ricci [mailto:ricci () cs ust hk]
> Sent: 24 May 2005 01:08
> To: security-basics () securityfocus com
> Subject: Checking when the OS was first installed
>
> Hello All,
>
> I was given a Windows XP Pro bootup hard disk for
> verification of its first installation date. What information
> I can verify when the hard disk was first installed?
>
> Secondly, if the OS was cloned and reproduced from another
> source, how can I verify that? Other than Norton Ghost, what
> other tools could be used for duplicating the hard disk?
> Besides, if I got a hard disk how can I verify what software
> (for cloning) it has been used?
>
> In a Windows XP platform, what is the use of Windows XP
> RestorePoint? What information I can collect from the
> RestorePoint? Is that related to backup information?
>
> Thanks.
>
> Ricci