Re: When the program was installed

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2007-06-06 Juan B wrote:
> I am working with a win 2000 pro machine.
> I need to do some basic forensics and know when a
> particilar program was installed, in which date and
> hour (optional). the program is seen in the Add and
> remove programs.
>
> How can I know when it was installed?

Issue a "dir /t:c" (or something similar) on the program directory.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq