Hello All,
Can anyone tell me where to find the last login time on Windows 98? To make it possibly more challenging I think I'm looking at a 95–>98 upgrade, so there is definitely no user accounts etc.
I've googled without any luck, and unfortunately my only real exposure to 98 was from a user perspective, rather than a forensic perspective!
Any help appreciated…thanks!
Can you just list all the files on the machine, then sort by date.
At least one file will have been updated at the last login.
(You can be almost sure the user didn't login and stay logged in for days, as Win98 just wasn't that stable).
Yeah that's basically what I've ended up doing…have the last write time from the swap file
Have you found a system.dat file? I believe those came out in 98, might have been 2000 though.