Tabeer wrote:
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate"
It's given as the number of seconds since January 1, 1970.
To convert that number into a readable date/time just paste the decimal value in the field "UNIX TimeStamp:" of Unix Time Conversion online tool.
Yep, the original post was more regarding the InstallTime values, which appears to be new in Win10.
InstallDate has been around a while.
If you want to automate the parsing of the two values use my updated winnt_cv regripper plugin
winnt_cv
↧