Forensics
Windows last shutdown Aug 02 2005 01:30PM
Stefano Bizzarri (nexius email it) (2 replies)
Re: Windows last shutdown Aug 02 2005 08:00PM
Valdis Kletnieks vt edu
Re: Windows last shutdown Aug 02 2005 12:48PM
John Kinsella (jlk thrashyour com)
Is the box running? "net statistics workstation" will show you how long
it's been running, if so. Probably not the exact answer you want, but
hopefully it points you in the right direction...

Actually (sorry, still waking up), windows almost always spews tons of
stuff into event logs, which should be easy to track down if you just
have a drive image.

John

On Tue, Aug 02, 2005 at 03:30:04PM +0200, Stefano Bizzarri wrote:
> Hi all...
>
> I'm writing here to now if someone knows the way to acquire the exact time and
> date when a Windows xx machine was shutted down the last time.
>
> I ever think that serching the swap files and aquireing their date and time I
> could know that but someone told me that It's not correct.
>
> Thanks for help
>
> Stefano Bizzarri

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus