3

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find out when X user logged in last time.

Then there is another question that asks whether there is anything wrong with those dates, and why? Indeed there is something wrong, and it's that the last time the user logged in was before the system was installed.

So my question is, is it possible to change the last login time? If so... how?

PS: the image is of Windows XP.

  • One way - look at the last modified (or acccess) time of the user's local profile – goodguys_activate Nov 21 '14 at 21:28
  • 1
    Assuming it's possible to gain privileges to arbitrarily write to the Event Log, and there's no particularly unique digital signature applied or checked for on it, (both of which I'm pretty sure are the case) I don't see why not. However, there are likely a lot of other artifacts you'd have to mess with to render this change undetectable by an educated investigator. – Iszi Nov 22 '14 at 1:48
  • @Iszi Even if there is some form of signature or check, all software can be reverse-engineered. Since some Windows component contains methods for dealing with this data, a determined hacker could figure out how it's done in every detail. From there they could manually make the change, or even write a tool to make the change. With this, it would also be possible to completely remove the record, or modify any aspect of the record. – Thebluefish Nov 22 '14 at 1:51
  • @Thebluefish True. Digital signatures are just another roadblock, here but they can be bypassed. Now, what's really tricky to get around is a system that's sending a live stream (or fairly frequent export) of its event logs to an aggregator. Then you've got two systems to worry about compromising and cleaning up after yourself on. – Iszi Nov 22 '14 at 1:59
4

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set.

So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the user wanted.

  • The old event log was numbered sequentially internally so this would be detectable. Does the new event log write events in date time order, or last written? – goodguys_activate Nov 22 '14 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.