Re: Checking when the OS was first installed

["Robert Reed" <rreed567 () earthlink net>]

Along the same lines..... you could look at the volumes on the disk and see
if they add to the total sectors available....if they are like disks then
they ( the total in available volumes + MBR) will equal the total available
sectors on the disk. If there is unallocated space the disk may have been
duplicated onto a disk on a different size.

----- Original Message ----- 
From: "Hindle, Dallas" <Dallas.Hindle () bakersdelight com au>
To: <ricci () cs ust hk>; <security-basics () securityfocus com>
Sent: Thursday, May 26, 2005 9:47 PM
Subject: RE: Checking when the OS was first installed


I don't believe there is anyway to tell if a HDD has been duplicated
with something like Ghost or other Disk imaging software. The point of
these products is to make an exact duplicate of the data on the disk.

However, you could check the serial no. on the disk or manafacture date
on the HDD and see if it sounds right for the pc's purchase date. If the
date is too old then it may have been a different disk, or if the disk
is newer than the purchase date of the pc it would also raisey
suspissions.






Dallas Hindle
Infrastructure Team Leader
Bakers Delight Holdings Limited.
Suite 1, Level 1
293 Camberwell Road
Camberwell, Victoria, 3124
Australia
p. +61 3 9811 6183
m. 0413 707 451
f. +61 3 9811 6100
w. www.BakersDelight.com.au
e. Dallas.Hindle () BakersDelight com au


-----Original Message-----
From: Ryan Kubiak [mailto:rkubiak () btc-bci com]
Sent: Friday, 27 May 2005 5:28 AM
To: Andrew Aris; ricci () cs ust hk; security-basics () securityfocus com
Subject: RE: Checking when the OS was first installed

Any repair of the Windows installation will change the date in
systeminfo,
and I'm fairly sure the registry key as well.  There is no easy way to
determine the original install date if someone is trying to hide that
information from you that I know of.

Ryan

-----Original Message-----
From: Andrew Aris [mailto:andrew () dev bigfishinternet co uk]
Sent: Tuesday, May 24, 2005 12:00 PM
To: ricci () cs ust hk; security-basics () securityfocus com
Subject: RE: Checking when the OS was first installed


> From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if
that
is a worry.

There is also a registry key in
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\

Although this is a DWORD so its not exactly human-friendly!

cheers,

Andrew

> -----Original Message-----
> From: ricci [mailto:ricci () cs ust hk]
> Sent: 24 May 2005 01:08
> To: security-basics () securityfocus com
> Subject: Checking when the OS was first installed
>
> Hello All,
>
> I was given a Windows XP Pro bootup hard disk for
> verification of its first installation date. What information
> I can verify when the hard disk was first installed?
>
> Secondly, if the OS was cloned and reproduced from another
> source, how can I verify that? Other than Norton Ghost, what
> other tools could be used for duplicating the hard disk?
> Besides, if I got a hard disk how can I verify what software
> (for cloning) it has been used?
>
> In a Windows XP platform, what is the use of Windows XP
> RestorePoint? What information I can collect from the
> RestorePoint? Is that related to backup information?
>
> Thanks.
>
> Ricci


-- 
Message protected by MailGuard: e-mail anti-virus, anti-spam and content
filtering.
http://www.mailguard.com.au/mg