Dear all,
I should analyse a Windows 10 Laptop and I would discover when the PC was formatted and reinstalled. (I should check if the PC owner is telling me the truth about it).
Which kind of check should I perform?
I thought to acquire the disks images and analyze them using Autopsy (tool timeline).
Are there any valuable information related to OS installation in the Windows Registry?
Thanks in advance
Best Regards
Andrea Liguoro
hi @liguoroa,
1.    Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
it gives full info of OS. install date will be in unix time(convert it).
2.    For a machine if it is upgraded go to HKEY_LOCAL_MACHINE\SYSTEM\Setup\
check the source OS keys.
For any other support join my Telegram channel foreignsikhs
Thanbk you
