3

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find out when X user logged in last time.

Then there is another question that asks whether there is anything wrong with those dates, and why? Indeed there is something wrong, and it's that the last time the user logged in was before the system was installed.

So my question is, is it possible to change the last login time? If so... how?

PS: the image is of Windows XP.

Improve this question
4
  • One way - look at the last modified (or acccess) time of the user's local profile
    – makerofthings7
    Commented Nov 21, 2014 at 21:28
  • 1
    Assuming it's possible to gain privileges to arbitrarily write to the Event Log, and there's no particularly unique digital signature applied or checked for on it, (both of which I'm pretty sure are the case) I don't see why not. However, there are likely a lot of other artifacts you'd have to mess with to render this change undetectable by an educated investigator.
    – Iszi
    Commented Nov 22, 2014 at 1:48
  • @Iszi Even if there is some form of signature or check, all software can be reverse-engineered. Since some Windows component contains methods for dealing with this data, a determined hacker could figure out how it's done in every detail. From there they could manually make the change, or even write a tool to make the change. With this, it would also be possible to completely remove the record, or modify any aspect of the record.
    – user41341
    Commented Nov 22, 2014 at 1:51
  • @Thebluefish True. Digital signatures are just another roadblock, here but they can be bypassed. Now, what's really tricky to get around is a system that's sending a live stream (or fairly frequent export) of its event logs to an aggregator. Then you've got two systems to worry about compromising and cleaning up after yourself on.
    – Iszi
    Commented Nov 22, 2014 at 1:59

1 Answer 1

Reset to default
4

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set.

So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the user wanted.

Improve this answer
1
  • The old event log was numbered sequentially internally so this would be detectable. Does the new event log write events in date time order, or last written?
    – makerofthings7
    Commented Nov 22, 2014 at 20:39

You must log in to answer this question.