Windows 10 Install dates

Finding out the Installation date in Windows 10

Why?

It is important to quickly understand when an operating system was installed. It is also information that is required for audit procedures.

Note; Windows 10 may have a date for the last major update (how could this be useful?)

Thankfully, an explanation is given by https://www.forensics-matters.com/2018/09/15/find-out-windows-installation-date/ in to where these are.

1)

PowerShell

$date = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\' | select -ExpandProperty InstallDate

So we are creating a variable called $Date

This variable equals the commands after the = sign

This is for powershell to get the property of the path in HKLM and then to select and expand the install date

Then…

(Get-Date "1970-01-01 00:00:00.000Z") + ([TimeSpan]::FromSeconds($date))

We are getting the date in the format shown in “ “ with the timespan being the from seconds seen in the registry- all from the date variable created earlier

2)

Acquire the SOFTWARE registry from an application like FTK

“\Windows\System32\Config\”

Load in to registry viewer by Access Data:

3)

Use the command prompt