Windows 10 OS Reins...
 
Notifications
Clear all

Windows 10 OS Reinstallation timestamp

liguoroa
(@liguoroa)
Junior Member

Dear all,
I should analyse a Windows 10 Laptop and I would discover when the PC was formatted and reinstalled. (I should check if the PC owner is telling me the truth about it).

Which kind of check should I perform?

I thought to acquire the disks images and analyze them using Autopsy (tool timeline).

Are there any valuable information related to OS installation in the Windows Registry?

Thanks in advance
Best Regards
Andrea Liguoro

Quote
Topic starter Posted : 22/01/2022 5:29 pm
mrevoluter
(@mrevoluter)
New Member

hi @liguoroa,

1.     Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion

it gives full info of OS. install date will be in unix time(convert it).

2.     For a machine if it is upgraded go to HKEY_LOCAL_MACHINE\SYSTEM\Setup\

check the source OS keys.

For any other support join my Telegram channel foreignsikhs

Thanbk you

ReplyQuote
Posted : 23/01/2022 5:58 pm
Share:
Share to...