Evidence of OS reinstall?

If you got time, you should also try Eric Zimmerman's Registry Explorer and ShellBags Explorer tools. Hopefully you could find some more relevant data with these

https://ericzimmerman.github.io/

Not that I dislike encase or any other software, it's just another idea I got. Results from different analysis might lead to a better way figuring your case )

will do. thanks passcodeunlock, I really appreciate all the help!

will do. thanks passcodeunlock, I really appreciate all the help!

You are welcome )

thanks for response guys - was traveling the past two days and just got back.

Viewing the Install Date key under 'Current Version' had an odd value. On the left hands side the value was B2 2A 5F 52 and on the right had side was this interesting string 2*_R. I figured the left hand side was hex and I converted it to decimal and then put that through a unix time converter but the date came back as September 20th 2064. But when I ran the Encase System Info module, that reported back that the install date was the October 2013 date. So not sure why the registry key and the system module have different information.

Assuming you haven't already solved this yourself, this might help!

What you had there was the 'Hex' tab selected in the view pane. The left side of the window shows the hex data, the right hand side is the ASCII conversion of that hex.

Putting B2 2A 5F 52 through a hex to ASCII converter brings back ²*_R, as you described.

I'm going out on a limb slightly and assuming you are using EnCase 7? All you need to do is highlight those four bytes, then switch to the 'Decode' tab. You can then decode it into various date formats, which will save the manual effort of converting to decimal and putting through a Unix date converter.

You'll kick yourself when I tell you this, but that hex value is little-endian. So rather than converting B2 2A 5F 52 to epoch time, which as you said gives a date of 20/9/2064, you should have converted 52 5F 2A B2!

That gives a date of 17/10/2013, 000922 UTC!!

Hope that helps!

Just in case (and additional to what tdaniels posted ) ) there is a nice, free tool to decode dates, called dcode
http//www.digital-detective.net/digital-forensic-software/free-tools/
that accepts directly the string
B2 2A 5F 52
(of course you need to select the appropriate date format)

jaclaz

Assuming you haven't already solved this yourself, this might help!

What you had there was the 'Hex' tab selected in the view pane. The left side of the window shows the hex data, the right hand side is the ASCII conversion of that hex.

Putting B2 2A 5F 52 through a hex to ASCII converter brings back ²*_R, as you described.

I'm going out on a limb slightly and assuming you are using EnCase 7? All you need to do is highlight those four bytes, then switch to the 'Decode' tab. You can then decode it into various date formats, which will save the manual effort of converting to decimal and putting through a Unix date converter.

You'll kick yourself when I tell you this, but that hex value is little-endian. So rather than converting B2 2A 5F 52 to epoch time, which as you said gives a date of 20/9/2064, you should have converted 52 5F 2A B2!

That gives a date of 17/10/2013, 000922 UTC!!

Hope that helps!

awesome info tdaniels. thank you!

Just in case (and additional to what tdaniels posted ) ) there is a nice, free tool to decode dates, called dcode
http//www.digital-detective.net/digital-forensic-software/free-tools/
that accepts directly the string
B2 2A 5F 52
(of course you need to select the appropriate date format)

jaclaz

adding that to my growing list of tools. thanks jaclaz!