Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What steps would you take to make a windows xp machine appear that it hasn't been logged on to since some past date. Not to a forensic level here, just to a casual inspection.

Fyi this is not intended to do anything destructive to someone elses machine. This is for my own use believe it or not.

And no, I'm not trying to hide from daddy that I used his computer. If you want to be sarcastic here, please come up with something half way amusing, thanks.

share|improve this question

migrated from serverfault.com Nov 9 '09 at 18:27

This question came from our site for system and network administrators.

closed as not constructive by William Hilsum, Diago Oct 4 '10 at 7:24

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

    
Go to the Dagobah system, and there you will meet Yoda, the SuperUser master who instructed me. –  mh Nov 9 '09 at 18:05
1  
Wow that is hilarious. –  KL Nov 9 '09 at 18:12
1  
Asking for no sarcastic answers is a really good way to make sure that you will get them. Doesn't make providing sarcastic answers right, however. –  Mike Chess Nov 9 '09 at 18:38

3 Answers 3

while it is fairly easy to change all file dates (see below) to any day in the past or the future, i would not recommend doing it, as it will most certainly wreak havoc, e.g. with your antivirus software, maybe with software that needed activation (certain manufacturers don't like such tampering) ... if you're ready to ignore all my severe warnings or if you have a drive backup handy, read on :)

if you happen to have Total Commander installed, open the C Drive, go to Files > Change Attributes ..., check the boxes Recurse Subdirectories and Change Date, enter the date (dd/MM/yyyy) of your choice and click OK.

share|improve this answer

Last Logon info is stored in the SAM, a special section of the registry that also stores passwords. You can use an offline registry editor to edit the relevant key to change the date.

Here's some helpful info on howto use the offline registry editor.

share|improve this answer

Check out this site for info about the location in the SAM. It also includes a utilty called ntdate to change a date into the proper format. Seach for "last logon" to find the relevent section on that page.

share|improve this answer