Date Mismatch on Wi...
 
Notifications
Clear all

Date Mismatch on WindowsXP-SP2

2 Posts
2 Users
0 Reactions
300 Views
(@lpcforensic)
Active Member
Joined: 18 years ago
Posts: 8
Topic starter  

HI All,

I have posted the same question in another Forum… but i don't got a reasonable answer.

So i post here my problem

i have a Windows XP ProF. Sp2 NTFS (only 1 Partition) where the date of Install is 25/04/2007 (Extract from Registry With FTK Registry View).

The "Created Time" of the boot.ini and pagefiles.sys is in the same day 25/04/2007

The OS language is ITALIAN (dd/mm/yyyy).

But, the Created Time of some programs in the "Program Files" is before of 25/04/2007.

Like this

Microsoft .NET Framework 2.0 2.0.50727 Microsoft Corporation 20070205
Microsoft .NET Framework 2.0 Language Pack - ITA 1.1.50727.42 Microsoft Corporation 20070205
Microsoft .NET Framework 3.0 3.0.04506.30 Microsoft Corporation 20070205
Microsoft .NET Framework 3.0 Italian Language Pack 3.0.04506.30 Microsoft Corporation 20070205
MSXML 6.0 Parser (KB927977) 6.00.3890.0 Microsoft Corporation 20070205
WebFldrs XP 0,496793981 Microsoft Corporation 20070205
Windows Communication Foundation 3.0.04506.30 Microsoft Corporation 20070205
Windows Communication Foundation Language Pack - ITA 3.0.04506.30 Microsoft Corporation 20070205
Windows Genuine Advantage Validation Tool (KB892130) 1.5.0530.0 Microsoft Corporation 20070205

(Extrated by Windows Registry Recovery 1.3.0 http//www.mitec.cz/).

I got the same informations if i chek the "Created Time" of the various Directory.

If can help, the serial number of the Volume C\ is 34C3-0D3B

I think the OS was reinstalled without format on 25/04/2007. It can be the right reason?

Thanks all…


   
Quote
(@jonathan)
Prominent Member
Joined: 20 years ago
Posts: 878
 

This was answered recently in this post

http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=1856

Hope it helps.


   
ReplyQuote
Share: