On my digital forensics course I need to analyze an image and look for evidences

Question

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find out when X user logged in last time.

Then there is another question that asks whether there is anything wrong with those dates, and why? Indeed there is something wrong, and it's that the last time the user logged in was before the system was installed.

So my question is, is it possible to change the last login time? If so... how?

PS: the image is of Windows XP.

Explanation / Answer

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set.

So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the user wanted.

Related Questions

Navigate

• Browse (All)
• Browse O
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.