Notifications
Clear all

CMOS battery change

5 Posts
3 Users
0 Reactions
425 Views
(@coloradoforensics)
Active Member
Joined: 13 years ago
Posts: 15
Topic starter  

Is there a way to identify in the CMOS or BIOS if/when the battery was last changed?


   
Quote
Passmark
(@passmark)
Reputable Member
Joined: 14 years ago
Posts: 376
 

There are (possible) event log entries for time changes. Depending on O/S and Audit settings.
e.g.
EventID 4616 - The system time was changed.

But this doesn't prove the battery was changed. I would be fairly sure there is not way to tell for sure that the battery was swapped out. There is no serial number or the like in these type of batteries.


   
ReplyQuote
(@coloradoforensics)
Active Member
Joined: 13 years ago
Posts: 15
Topic starter  

Excellent, thank you for the information.


   
ReplyQuote
(@jackyfox)
Eminent Member
Joined: 15 years ago
Posts: 20
 

I'm not sure why you need to know this but perhaps this might help.

Typically a user would only change a battery if it lost power. Most system BIOS have a default date/time which the system reverts to when the battery power is lost. You can probably get this date/time for the specific BIOS by googling it. If you have the original system you can check this by removing the battery and booting the system.

You can then search for any file timestamps created on shortly after that time. This may indicate that the battery power was lost/removed at some stage. You may even be able to estimate when this was by looking at gaps in timeline patterns.


   
ReplyQuote
(@coloradoforensics)
Active Member
Joined: 13 years ago
Posts: 15
Topic starter  

I know it does seem like a ridiculous question, but unfortunately we need to try to have it answered. Thank you for another option for us!


   
ReplyQuote
Share: