I am looking for recommendations on how to accurately identify and date Microsoft operating systems, in particular Windows 95/98/ME/2K/XP, when analyzing images of systems. I am aware of the registry key "FirstInstallDateTime" for dating the operating system installation. I am not clear however on whether this key represents the first installation of that particular version of Windows (e.g. an upgrade date, 98->2K) or does this date first install date of any MS operating system on that machine, regardless of upgrades? Are there better ways to identify: 1.) The installation date of the current version of MS operating system, and 2.) The installation date of the first MS operating system on a machine? Also, in terms of identification, would registry keys be the most authoritative way to determine which version of MS operating system is installed? Thanks for the assistance, Mark ------------------------------------------- Introducing NetZero Long Distance Unlimited Long Distance only $29.95/ month! Sign Up Today! www.netzerolongdistance.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sun Sep 08 2002 - 10:44:26 PDT