RE: Registry Key LastWrite times

From: Frank Heyne (fhat_private-dresden.de)
Date: Wed May 30 2001 - 09:28:45 PDT

  • Next message: crazytrain.com: "RE: Determining if someone copied file to a: drive" 

    On 30 May 2001, at 6:27, VanMeter, John wrote:

> What subkeys under HKLM and HKCU contains this gold mine of information?

Similiar to every file, *every* Registry key has a time stamp as well. The 
difference is that a Registry key only contains one time stamp (last write). 
So you only can read the time when the *last* value under any key was 
changed, nothing more. It does work only under Win NTx, not Win9x





Frank Heyne

    This archive was generated by hypermail 2b30 : Wed May 30 2001 - 18:39:29 PDT