How to change meta data of a registry key?

Question

According to Wikipedia: "The Windows registry can be edited manually using programs such as regedit.exe, although these tools do not expose some of registry's metadata such as the last modified date."

Which tool can I use to change the last modified date and other meta data of a registry key?

Answer 1

There are utilities which can show you the "last modified date" of a key.
(For a solution for changing the timestamp look at the bottom of this answer.)

---

Even with "regedit.exe" you can determining the "Last Write Time" of a registry key:

• Click Start, Run and type Regedit.exe
• Navigate to the key for which you want to determine the last write time
• From the File menu, click Export.
• In the Save As type drop-down box, select Text Files (*.txt)
• Type a file name and press Enter
• Open the text file using Notepad, and look at the Last Write Time value.

Sample:

Key Name:          HKEY_USERS\.DEFAULT\Control Panel\Desktop
Class Name:        <NO CLASS>
Last Write Time:   3/5/2006 - 11:45 AM
Value 0
  Name:            ActiveWndTrkTimeout
  Type:            REG_DWORD
  Data:            0x0

Value 1
  Name:            AutoEndTasks
  Type:            REG_SZ
  Data:            0

You can find these instructions on this site here.
There it says you can also use the Regscanner from Nirsoft.

Here is also a good article about A Forensic Analysis Of The Windows Registry.

---

If you want to change these timestamps you could look at the utility SetRegTime.