2

According to Wikipedia: "The Windows registry can be edited manually using programs such as regedit.exe, although these tools do not expose some of registry's metadata such as the last modified date."

Which tool can I use to change the last modified date and other meta data of a registry key?

1 Answer 1

2

There are utilities which can show you the "last modified date" of a key.
(For a solution for changing the timestamp look at the bottom of this answer.)


Even with "regedit.exe" you can determining the "Last Write Time" of a registry key:

  • Click Start, Run and type Regedit.exe
  • Navigate to the key for which you want to determine the last write time
  • From the File menu, click Export.
  • In the Save As type drop-down box, select Text Files (*.txt)
  • Type a file name and press Enter
  • Open the text file using Notepad, and look at the Last Write Time value.

Sample:

Key Name:          HKEY_USERS\.DEFAULT\Control Panel\Desktop
Class Name:        <NO CLASS>
Last Write Time:   3/5/2006 - 11:45 AM
Value 0
  Name:            ActiveWndTrkTimeout
  Type:            REG_DWORD
  Data:            0x0

Value 1
  Name:            AutoEndTasks
  Type:            REG_SZ
  Data:            0

You can find these instructions on this site here.
There it says you can also use the Regscanner from Nirsoft.

RegScanner

Here is also a good article about A Forensic Analysis Of The Windows Registry.


If you want to change these timestamps you could look at the utility SetRegTime.

SetRegTime

2
  • Thanks for the link to the mft2csv project; they have a bunch of low-level forensic-type tools which I love.
    – Synetech
    Oct 6, 2013 at 13:41
  • Thanks! To get the time stamp associated with \HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer, I ran setregtime "\registry\user\S-X-X-XX-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXX\Software\Microsoft\Internet Explorer" (user SID obfuscated). More info is available on the setregtime wiki page. The user SID I found by running wmic useraccount get name,sid.
    – feklee
    Oct 6, 2013 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.