Fluffy Posted October 31, 2006 Report Share Posted October 31, 2006 Hello !Does anybody happen to know what registry entry (or what file) has the informationabout which date the Operating System was installed on the computer ?thanks a bunch in advance,-Fluffy Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted October 31, 2006 Report Share Posted October 31, 2006 Interesting question! :) I did a little research and found the following. Open a command prompt (Start -> Run -> cmd), then type the following commandsysteminfo | find /i "install date"At least this is to find out about the install date. Where it is actually stored may need a bit of additional research... Quote Link to comment Share on other sites More sharing options...
Fluffy Posted October 31, 2006 Author Report Share Posted October 31, 2006 thanks...it'd be nice to use "systeminfo"....however...i have a *raw* image of a file system (a .image file aquired with forensic imaging software)...which means I don't have a windows OS per se, and I can't use any of the windows utilities...I can merely browse through the directory structure...I'll keep searching... --Fluffy Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted November 1, 2006 Report Share Posted November 1, 2006 Which means that you can't look at the registry either...? Quote Link to comment Share on other sites More sharing options...
Fluffy Posted November 1, 2006 Author Report Share Posted November 1, 2006 I can definitely see the registry. I've got all the registry files (Software, System, SAM, Security, Default and UserDiff)...My problem is I can't figure out which key will tell me the date of installation of the Operating System (or other keys which I need, like the processor, RAM, or MAC address). I mean, I've gone through all the keys and none of them seems to say "i-n-s-t-a-l-l-a-t-i-o-n d-a-t-e"... Does there exist some sort of a "documentation" for windows registries which details all the keys and their meanings ? (i know, this would be too much to hope for :))--Fluffy Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted November 1, 2006 Report Share Posted November 1, 2006 I do not know the physical layout of the registry, and I doubt that there is any such documentation. The only thing that is documented to my knowledge is how to read and write from and to the registry from an application program. Other than that, the Registry Editor 'regedit' is used to analyze of modify the registry.The registry contents has three levels:Keys and SubkeysValuesDataIn your case, the 'InstallDate' is not a key, but a value, with e.g. "20021001" as data. However, so far I haven't located which key holds the Windows install date.[Edit] Found that 'InstallDate' is only for installed software products, not Windows itself. Sorry, I cannot find where the Windows install date is kept. Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted November 1, 2006 Report Share Posted November 1, 2006 The key is in hex. Its located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"InstallDate"or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion"InstallDate"InstallDate REG_DWORD Time (in seconds) since 12:00 A.M. on January 1, 1970Stores the date and time that the current build of Windows NT was installed. For example, Monday, January 01, 1996, 12:00:00 AM would be 0x30E76A50 (820,472,400 seconds).I'm sure someone made a script somewhere to figure that up into something meaningful. An excel formula maybe? Quote Link to comment Share on other sites More sharing options...
playaj20008 Posted November 1, 2006 Report Share Posted November 1, 2006 Another way to find out is to go into system restore and look at the first restore point created at installation. Quote Link to comment Share on other sites More sharing options...
Fluffy Posted November 2, 2006 Author Report Share Posted November 2, 2006 Thanks a lot, Cozofdeath!!Please , tell me, how do you know that the value represents the time in seconds since January 1, 1970 ?I mean, where did you read this information? I would really like to know because I want to knowmore such tiny details about the registries, and I cannot find it anywhere on the web! Please tell me wheredid you read it!!thanks a *lot* again! --FluffyThe key is in hex. Its located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"InstallDate"or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion"InstallDate"InstallDate REG_DWORD Time (in seconds) since 12:00 A.M. on January 1, 1970Stores the date and time that the current build of Windows NT was installed. For example, Monday, January 01, 1996, 12:00:00 AM would be 0x30E76A50 (820,472,400 seconds).I'm sure someone made a script somewhere to figure that up into something meaningful. An excel formula maybe? Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted November 3, 2006 Report Share Posted November 3, 2006 Actually for once I knew where the registry key was, so I looked it up by typing its full key name in google and a forum member on a site google returned said the keys value is based on the number of seconds since 12:00 A.M. on January 1, 1970 which is Unix time. Many things that rely on time go by UTC. If you want to convert the time you found in that key you can go HERE but make sure you enter the decimal amount and you set the GMT to your location. I think also since its a dword value it can hold four bytes worth (30E76A50 - 30:1 byte E7:1 byte 6A:1 byte 50:1byte), so its perfect to hold the time and should be able to hold a value up to FFFFFFFF or 4,294,967,296 in decimal. Hope it helps. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.