What may be the reason behind the fact that in a digital forensics report (FSL report) of a computer's hard disk, the last logon time of the Administrator user in Windows 7 system is prior to the OS installation date?

Does it infer tampering of the Hard disk before examination?

  • Has the built-in Administrator account ever been used? Does the last logon time default to e.g. build time in such case? – Esa Jokinen Mar 31 at 14:29
  • @EsaJokinen That may be a case.. is there a way to find the default build in time for Windows 7 ultimate? – Gradient Mar 31 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.