12

Is there any sort of date tracking that is done or viewable in the Windows registry, such as seeing the date when X key was created, or Y key was modified, similar to how file systems track?

I'm trying to find changes that were made to specific areas of the registry during certain date ranges, and it would be fantastic if there was a way to work with date data.

1
  • You can start using this software to take snapshots of the registry to compare later, may not help you right now but will make it easier in the future>>>>sourceforge.net/projects/regshot
    – Moab
    Jan 13, 2020 at 18:07

2 Answers 2

12

Registry keys have a last-modified timestamp. You can use Regedit to export a key, selecting the ".txt" output format. That text file will contain the last modified date&time.

NirSoft's RegScanner utility allows one to filter selected registry keys by ranges of the last-modified timestamp.

2
  • Wow, super useful. Never knew this was possible. And that tool will be just as useful. Thanks. Feb 7, 2021 at 8:56
  • Both suggested methods (key export and RegScanner tool) show last modification time for a reg key but not for each value inside a reg key. If the Registry records last modification time for values inside a reg key, is there a method to view those time stamps?
    – rpr
    Oct 17, 2022 at 13:57
0

There are a number of forensics-related scripts online that can help accomplish this. If you know the key(s) and there's a reasonable number, you can also export them to a .txt file in the registry editor. The LastWrite date/time will be there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .