Security Basics mailing list archives

Re: Checking when the OS was first installed

From: "Hostas.lt" <klientai () hostas lt>
Date: Tue, 31 May 2005 16:23:35 +0300

On 2005-05-29 Lubrano di Ciccone, Christophe (DEF) wrote:

The date of the boot.ini file or the winnt folder (%systemroot%) may
help you.


Maybe, but since it's the configuration file for the bootloader, it is
prone to changes, so this seems very unreliable to me.

Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

There are system.sav and software.sav files in Windows\System32\Configwhich are

dated the system installation time.

Current thread:

RE: Checking when the OS was first installed Hindle, Dallas (May 27)
- Re: Checking when the OS was first installed Robert Reed (May 30)
- <Possible follow-ups>
- RE: Checking when the OS was first installed Lubrano di Ciccone, Christophe (DEF) (May 30)
  - Re: Checking when the OS was first installed Ansgar -59cobalt- Wiechers (May 31)
    - Re: Checking when the OS was first installed Hostas.lt (May 31)