Notifications
Clear all
Topic starter
17/05/2008 1:43 am
hai to everybody,
how to find the OS running/date of installation of the OS in hard disk through offline analysis without applying any third party tool like registry viewer of FTK etc. what files reveal this info on analysis of the hard disk?
thanks
krishna
17/05/2008 2:16 am
Why no third-party tools? Are you just opening the Registry files in a hex viewer or what? Almost any tool other than RegEdit is in essence a third-part tool. Even if you do not use Registry Viewer, there are some great tools like those available from Harlan that parse the Registry.
Or is the question about reading the System.dat or NTUser.dat files?