Does anything other than the installation of the operating system change the OS install date value under HKLM\SOFTWARE\MICROSOFT\WindowsNT\CurrentVersion? The OS is Win7 Ultimate.
I have a drive that has the OS install date of 1/26/11, but the $MFT was created on 1/23/11, and other items such as reg files from the regback folder have the 1/23/11 date as well. I understand that the $MFT creation date would be from the date the drive was formated, but I am concerned by the amount of items that have the 1/23 creation date. Could the 1/26 installation have been installed right over top of one from 1/23?
Any input is appriciated!
Somebody started an install and left it unattended and it only got part of the way through without user interaction and then came back to finish it a few days later. I had one like this where a user had started an install late evening and then came back the next day to finish it.
H
Thanks! I ran a test overnight and I am seeing the same thing.