On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find out when X user logged in last time.
Then there is another question that asks whether there is anything wrong with those dates, and why? Indeed there is something wrong, and it's that the last time the user logged in was before the system was installed.
So my question is, is it possible to change the last login time? If so... how?
PS: the image is of Windows XP.