Does the Registry record BIOS or software clock time changes?

[aquaman]

Hi all!

I am documenting file, folder and photograph creation, modified and last accessed times and dates for an accurate record of when specific docs were put on a computer.

In the properties of each one there are times and dates recorded, but I think that some of the photos and documents have been created by a colleague changing the BIOS time on boot up and/or the software time and date in order to demonstrate that they were created some time ago.

 

Is there anywhere on the computer that i can find out if and when the BIOS and software time and date was changed?

 

It was mentioned to me that the registry records every time the BIOS clock and the software clock has been changed. Is that true? and if so where would I find it in the registry?

 

Thanks again!

[Plastic Nev]

Now that is a difficult question, you just may find those changes and when in the Windows events logs, but it will be a painstaking search as those logs record everything going on. It also depends on how far back those logs go too. If a time limit of say six months is set for keeping the logs, then all those before then will have been deleted.

Someone with better knowledge of registry may have better ideas though, so hang on till one of our other advisor's sees this.

Nev.

[RandyL]

Anything done in the BIOS is done outside of the Windows environment. As such no registry values are used.

It was mentioned to me that the registry records every time the BIOS clock and the software clock has been changed

The registry is like the central nervous system for Windows. It is used to make Windows, software and hardware functional. It is not a data recorder.

 

It will show only what is not what was or when what was except as provided by the software itself.

[aquaman]

Does that mean that the time changes will not be anywhere on the system?

 

So if someone changed the BIOS time and then booted to windows, they could write a new document or download something at a backdated date and there is no way that I can prove that they did that?

 

Thanks

[Synapse]

It may be easier to detect a date change than a time change.

 

Thinking it through, if you change the time in the BIOS Windows will boot and the System log will just stamp the new times on all entries - it does not know any different. The caveat is that if Windows is set to automatically update the time from the Internet it may do just that. You could then see a step change in the log entries from one time to another whilst Windows is running and adding to the log. It would have to be a significant change and I think it would need to be obvious for you to find it.

 

So, if the date was changed in the BIOS, Windows would not know right date from wrong date and just datestamp all log entries. If I knew a computer was started every day then I would look through the System log for each day's startup entries, any BIOS messing would be reflected and you could find a gap in dates, or odd startup/reboots on the same day. Other entries may help, like software install logs, or Internet cookie time/date stamps.

 

If you think the PC was used on the net, there may be a chance of viewing the timestamps from cookies or index.dat, you'll have to do some reading up on the subject, its getting into forensics, perhaps ask on a specialist forum more about it.