DIGITAL FORENSICS:HOW TO CHECK WINDOWS INSTALL DATE

DIGITAL FORENSICS:How to Check windows install date

วิธีการตรวจสอบวันและเวลาที่ทำการติดตั้ง Windows

Step 1 : Check Windows 10 installation date by Command Prompt >systeminfo

Step 2: Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Then on the right-side pane locate the InstallDate key and its value. There in the brackets, it displays a number in seconds. You can convert it into the date, which is just your Windows 1installation date.

Install Date 5c3e58a2

DCode Format: Unix:32 bit Hex Value - Big Endian

Step 3 Convert Date by Dcode software > Wed, 16 January 2019 05:03:14 +0700

Step 4 Windows Install Date  Value = 1547589794

Step 5 Convert Date by Dcode software > Wed, 16 January 2019 05:03:14 +0700

Decode Format : Numeric  

Windows Install Date  Value = 1547589794

Dcode Format: Unix:Numeric Value

Date & Time : Wed, 16 January 2019 05:03:14 +0700

Alternative: Or you can type WMIC OS GET installdate and press Enter key to get the installation date.

WMIC OS GET installdate

Step 6 Navigate to C:\Windows\System32\winevt . I have a snapshot of my system previous to the supposed install date of 16 January 2019. Note the created dates on the Event Logs - 16 January 2019:

Step 7. Navigate to MFT record  by FTKImager > Date Create

Extract data and timeline from Master File Table on NTFS filesystem.

1/15/2019 1:45:53 PM

  MFTExplorer  load $MFT

https://ericzimmerman.github.io/#!index.md

(1/15/2019 13:45:53 )

Step 8. view your Windows Update history.

Step 9. Windows 10 OS has yet another registry subkey, this one in the SYSTEM hive file:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\

The Install Date information here is the original computer OS install date/time. It also tells you when the update started, ie

 Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on xxxxxx)."

Previous installation dates and times can be found in the following hive: SYSTEM\Setup\Source OS (Updated on MM/DD/YYYY HH:MM:SS)

Step 10.The following steps provide the most accurate way to check for the Windows installation date.

    10.1 Open File Explorer and double left click on the C: drive >Look for the Windows folder 

    10.2 Right click on the Windows folder and select properties

Windows Properties.

10.3 Right click on the User Profile folder and select properties (1-16-2019 5:03)

User Properties

Look for the Create date of the User folder.

Note: The original install date provided by System Info reflects major changes to Windows, including a "Reset This PC" or major Window updates. The method above is the preferred way of finding the installation date.

When a partition was created/Modify (Master File Table)

REF:

check-windows-10-installation-date/

what-the-last-version-of-windows-means-for-digital-forensics/

/when-windows-lies

determining-windows-10-installation-date

how-do-i-tell-if-windows-10-was-a-fresh-install-or-upgrade

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ