|
What steps would you take to make a windows xp machine appear that it hasn't been logged on to since some past date. Not to a forensic level here, just to a casual inspection. Fyi this is not intended to do anything destructive to someone elses machine. This is for my own use believe it or not. And no, I'm not trying to hide from daddy that I used his computer. If you want to be sarcastic here, please come up with something half way amusing, thanks. | |||||||||||
feedback
|
This question came from our site for system administrators and desktop support professionals.
This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.
|
while it is fairly easy to change all file dates (see below) to any day in the past or the future, i would not recommend doing it, as it will most certainly wreak havoc, e.g. with your antivirus software, maybe with software that needed activation (certain manufacturers don't like such tampering) ... if you're ready to ignore all my severe warnings or if you have a drive backup handy, read on :) if you happen to have Total Commander installed, open the C Drive, go to Files > Change Attributes ..., check the boxes Recurse Subdirectories and Change Date, enter the date (dd/MM/yyyy) of your choice and click OK. | |||
|
feedback
|
|
Last Logon info is stored in the SAM, a special section of the registry that also stores passwords. You can use an offline registry editor to edit the relevant key to change the date. Here's some helpful info on howto use the offline registry editor. | |||
|
feedback
|
|
Check out this site for info about the location in the SAM. It also includes a utilty called ntdate to change a date into the proper format. Seach for "last logon" to find the relevent section on that page. | |||
|
feedback
|
