I'm looking at a Win XP HD and see that its OS install was 11/10, however at some point the image was updated (I'm seeing restore points from March of this year). Where in the registry would it record image updates to the OS?
Thanks.
I'm sorry, but your post isn't that clear on what you're looking for…
If the system had been installed in Nov, 2010, and the system was running after that, wouldn't it stand to reason that it was updated?
If you're seeing Restore Points from March of this year, then my question would be, when was the image acquired? If the image was acquired after March, then this would seem to make sense.
The registry key for when windows was installed shows 11/10, however I'm seeing restore points from March. I can't seem to make sense of this. Perhaps an updated image was installed in March and thus the restore points, however where else in the registry would it record this action?
Sorry for the confusion in my posting, but it has a lot to do with me being confused about these dates and what exactly happen as I'm not sure where else to look and confirm that the image was updated with a later image (that perhaps was patched, etc.).
I still don't follow what you're asking…
If the system was installed in 2010, and used, and then not acquired until after March of this year, this all makes sense. You still haven't provided any indication of when the image you're looking at was acquired.
It seems to me that the confusion may be coming from the fact that you appear to be assigning meaning to artifacts that you're seeing that may simply not apply.
A Windows XP system could have easily been installed in 2010, and continued to be used through March of this year. This would account for the installation date that you're seeing, as well as the Restore Points. What I don't understand is what it is you're seeing that makes you think that an "updated image" (and I still have no idea what that is…) was installed. Are you suggesting that a later version of Windows XP was installed over the one that was installed in 2010?
The registry key for when windows was installed shows 11/10, however I'm seeing restore points from March.
I can't seem to make sense of this. Perhaps an updated image was installed in March and thus the restore points, however where else in the registry would it record this action?
It sounds as if you thought restore points were strongly associated with OS installation?
They're not. Most updates/patches from Windows Update create restore points. Most software installations also create them, and the user can also create them manually.
For more details, look for material on 'System Restore' in Windows-related documention. (Google for "Technet XP System Restore", for example – TechNet gives you lots of information on the management and deployment of Microsoft software; very useful for IT specialists, and anyone interested in how Windows works.)
yes, and if that's the case which artifact could confirm this?
I understand what you are saying. i guess it's my lack of understanding restore points. But I'm seeing an IP address in the restore point that is not the system's IP, therefore I'm thinking that an updated (new version) of the OS was installed? But again, not sure.
yes, and if that's the case which artifact could confirm this?
Confirm what, specifically?
I understand what you are saying. i guess it's my lack of understanding restore points. But I'm seeing an IP address in the restore point that is not the system's IP, therefore I'm thinking that an updated (new version) of the OS was installed? But again, not sure.
The IP address "in" the Restore Point could be anything…without knowing more about the artifact (ie, location, etc.), it's hard to tell. IP addresses can end up in Restore Points for a wide variety of reasons, one of which is that the System Registry hive is backed up. Another is that the Software and NTUSER.DAT Registry hives are also backed up…these can all contain IP addresses.
To say that the reason that you feel that an "updated image" was installed because you see Restore Points doesn't make a great deal of sense, I'm afraid. Further, to say that you feel that an "updated image" was installed because you see "an IP address" in a Restore Point that isn't the IP address of the system itself also doesn't make a great deal of sense, particularly without context.
_Registry_Windows_Software in the restore point contains an IP address that is different from the system. How does this happen?
Again, there simply isn't any context…the Software hive may contain it, but to which key, value, or data are you referring?
The IP address assigned to a system, either via DHCP or statically, is most often found in the TCPIP parameters within the System hive.
"An IP address" is the Software hive could be anything…again, without context, there's really no way to address your question.
Is it possible that at the time of installation the system date was incorrect? You could also check the event logs - do they exist prior to March?