Security Basics mailing list archives
RE: Checking when the OS was first installed
From: "Hindle, Dallas" <Dallas.Hindle () bakersdelight com au>
Date: Fri, 27 May 2005 14:47:39 +1000
I don't believe there is anyway to tell if a HDD has been duplicated with something like Ghost or other Disk imaging software. The point of these products is to make an exact duplicate of the data on the disk. However, you could check the serial no. on the disk or manafacture date on the HDD and see if it sounds right for the pc's purchase date. If the date is too old then it may have been a different disk, or if the disk is newer than the purchase date of the pc it would also raise suspissions. Dallas Hindle Infrastructure Team Leader Bakers Delight Holdings Limited. Suite 1, Level 1 293 Camberwell Road Camberwell, Victoria, 3124 Australia p. +61 3 9811 6183 m. 0413 707 451 f. +61 3 9811 6100 w. www.BakersDelight.com.au e. Dallas.Hindle () BakersDelight com au -----Original Message----- From: Ryan Kubiak [mailto:rkubiak () btc-bci com] Sent: Friday, 27 May 2005 5:28 AM To: Andrew Aris; ricci () cs ust hk; security-basics () securityfocus com Subject: RE: Checking when the OS was first installed Any repair of the Windows installation will change the date in systeminfo, and I'm fairly sure the registry key as well. There is no easy way to determine the original install date if someone is trying to hide that information from you that I know of. Ryan -----Original Message----- From: Andrew Aris [mailto:andrew () dev bigfishinternet co uk] Sent: Tuesday, May 24, 2005 12:00 PM To: ricci () cs ust hk; security-basics () securityfocus com Subject: RE: Checking when the OS was first installed
From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if that is a worry. There is also a registry key in HKLM\Software\Microsoft\WindowsNT\CurrentVersion\ Although this is a DWORD so its not exactly human-friendly! cheers, Andrew
-----Original Message----- From: ricci [mailto:ricci () cs ust hk] Sent: 24 May 2005 01:08 To: security-basics () securityfocus com Subject: Checking when the OS was first installed Hello All, I was given a Windows XP Pro bootup hard disk for verification of its first installation date. What information I can verify when the hard disk was first installed? Secondly, if the OS was cloned and reproduced from another source, how can I verify that? Other than Norton Ghost, what other tools could be used for duplicating the hard disk? Besides, if I got a hard disk how can I verify what software (for cloning) it has been used? In a Windows XP platform, what is the use of Windows XP RestorePoint? What information I can collect from the RestorePoint? Is that related to backup information? Thanks. Ricci
-- Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering. http://www.mailguard.com.au/mg
Current thread:
- RE: Checking when the OS was first installed Hindle, Dallas (May 27)
- Re: Checking when the OS was first installed Robert Reed (May 30)
- <Possible follow-ups>
- RE: Checking when the OS was first installed Lubrano di Ciccone, Christophe (DEF) (May 30)
- Re: Checking when the OS was first installed Ansgar -59cobalt- Wiechers (May 31)
- Re: Checking when the OS was first installed Hostas.lt (May 31)
- Re: Checking when the OS was first installed Ansgar -59cobalt- Wiechers (May 31)