Saturday, January 19, 2019

DIGITAL FORENSICS:HOW TO CHECK WINDOWS INSTALL DATE

DIGITAL FORENSICS:How to Check windows install date

วิธีการตรวจสอบวันและเวลาที่ทำการติดตั้ง Windows

Step 1 : Check Windows 10 installation date by Command Prompt >systeminfo

Step 2: Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Then on the right-side pane locate the InstallDate key and its value. There in the brackets, it displays a number in seconds. You can convert it into the date, which is just your Windows 1installation date.

Install Date 5c3e58a2
DCode Format: Unix:32 bit Hex Value - Big Endian
Step 3 Convert Date by Dcode software > Wed, 16 January 2019 05:03:14 +0700


Step 4 Windows Install Date  Value = 1547589794
HOW TO CHECK WINDOWS INSTALL DATE

Step 5 Convert Date by Dcode software > Wed, 16 January 2019 05:03:14 +0700

CHECK WINDOWS INSTALL DATE
Decode Format : Numeric  

Windows Install Date  Value = 1547589794
Dcode Format: Unix:Numeric Value
Date & Time : Wed, 16 January 2019 05:03:14 +0700

CHECK WINDOWS INSTALL DATE



Alternative: Or you can type WMIC OS GET installdate and press Enter key to get the installation date.

WMIC OS GET installdate

Step 6 Navigate to C:\Windows\System32\winevt . I have a snapshot of my system previous to the supposed install date of 16 January 2019. Note the created dates on the Event Logs - 16 January 2019:


Step 7Navigate to MFT record  by FTKImager > Date Create
Extract data and timeline from Master File Table on NTFS filesystem.
1/15/2019 1:45:53 PM
  MFTExplorer  load $MFT
https://ericzimmerman.github.io/#!index.md

(1/15/2019 13:45:53 )

Step 8. view your Windows Update history.

Windows Update history.

Windows Update history.

Windows Update history

Step 9. Windows 10 OS has yet another registry subkey, this one in the SYSTEM hive file:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\
The Install Date information here is the original computer OS install date/time. It also tells you when the update started, ie
 Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on xxxxxx)."
Previous installation dates and times can be found in the following hive: SYSTEM\Setup\Source OS (Updated on MM/DD/YYYY HH:MM:SS)


Step 10.The following steps provide the most accurate way to check for the Windows installation date.

    10.1 Open File Explorer and double left click on the C: drive >Look for the Windows folder 
    10.2 Right click on the Windows folder and select properties
Look for the Create date of the folder
Windows Properties.

10.3 Right click on the User Profile folder and select properties (1-16-2019 5:03)
CHECK WINDOWS INSTALL DATE

User Properties

Look for the Create date of the User folder.

Note: The original install date provided by System Info reflects major changes to Windows, including a "Reset This PC" or major Window updates. The method above is the preferred way of finding the installation date.


When a partition was created/Modify (Master File Table)


how-do-i-tell-if-windows-10-was-a-fresh-install-or-upgrade

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD


หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

No comments:

Post a Comment

Digital Forensics:WhatsMyName (OSINT)

Digital Forensics:WhatsMyName (OSINT) Welcome to WhatsMyName This tool allows you to enumerate usernames across many websites How to use: 1....