HI All,
I have posted the same question in another Forum… but i don't got a reasonable answer.
So i post here my problem
i have a Windows XP ProF. Sp2 NTFS (only 1 Partition) where the date of Install is 25/04/2007 (Extract from Registry With FTK Registry View).
The "Created Time" of the boot.ini and pagefiles.sys is in the same day 25/04/2007
The OS language is ITALIAN (dd/mm/yyyy).
But, the Created Time of some programs in the "Program Files" is before of 25/04/2007.
Like this
Microsoft .NET Framework 2.0 2.0.50727 Microsoft Corporation 20070205
Microsoft .NET Framework 2.0 Language Pack - ITA 1.1.50727.42 Microsoft Corporation 20070205
Microsoft .NET Framework 3.0 3.0.04506.30 Microsoft Corporation 20070205
Microsoft .NET Framework 3.0 Italian Language Pack 3.0.04506.30 Microsoft Corporation 20070205
MSXML 6.0 Parser (KB927977) 6.00.3890.0 Microsoft Corporation 20070205
WebFldrs XP 0,496793981 Microsoft Corporation 20070205
Windows Communication Foundation 3.0.04506.30 Microsoft Corporation 20070205
Windows Communication Foundation Language Pack - ITA 3.0.04506.30 Microsoft Corporation 20070205
Windows Genuine Advantage Validation Tool (KB892130) 1.5.0530.0 Microsoft Corporation 20070205
(Extrated by Windows Registry Recovery 1.3.0 http//
I got the same informations if i chek the "Created Time" of the various Directory.
If can help, the serial number of the Volume C\ is 34C3-0D3B
I think the OS was reinstalled without format on 25/04/2007. It can be the right reason?
Thanks all…
This was answered recently in this post
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=1856
Hope it helps.