How to find the install date of Windows operating system without the Registry or command prompt?

Question

I am looking at the dumped files of a Windows XP computer. I do not have access to the Registry, just all of the files from the computer itself. I want to figure out on what date the operating system was installed, but most responses online say to either look in the Registry or use the systeminfo command to find it (and the systeminfo.exe program obviously fails to run because it does not have the Registry to check for some parts of it).

So is there a way to find what date Windows was installed without access to the registry? What file does systeminfo check to retrieve that information? Or does it use the Registry?

Answer 1

If you have the Windows folder from your dead PC as a backup, then you have all you need.

You can load the registry of a dead PC into your registry editor. After that, you can look under

HKEY_LOCAL_MACHINE\<deadRegistry>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate 

---

Step by step

1. Open your registry editor (Win+R » regedit.exe)
2. Select HKEY_LOCAL_MACHINE
   _{(Strangely, this step is needed. Otherwise File » Load Hive is greyed out)}
3. In your menu bar, click on File » Load Hive...

4. Navigate to and open

   <your Windows backup>\Windows\system32\config\SOFTWARE
   

   SOFTWARE is the file we want in our case since it holds the install date. But there are other files which contain other parts of your dead registry

5. A new key will be created under your HKEY_LOCAL_MACHINE key. Give it a meaningful name like Dead PC Software Hive

   

6. Now you should be able to navigate to

   HKEY_LOCAL_MACHINE\<Dead PC Software Hive>\SOFTWARE\Microsoft\Windows NT\CurrentVersion
   

7. In the right pane you'll see a REG_DWORD called InstallDate and it's value. For example mine shows 59e074ec. You can convert the HEX or DEZ value with any online converter into a readable format

8. Don't forget to unload the hive once you’re done. Select the key Dead PC Software Hive and click on File » Unload Hive...

---

Used resources

• Accessing Another Windows Computer’s Registry from a Disk in Windows 8.1
• How to Determine the Windows Installation Date with and without PowerShell
• https://www.epochconverter.com/

Answer 2

The Event Viewer may shed light on this, so long as the logs go back to the system install.

In Windows XP, these would be .evt files stored in %SystemRoot%\System32\Config

You should be able to open these in the Event Viewer on a working Windows computer by right-clicking on the Event Viewer (Local) entry at the top of the tree, and selecting Open saved log...

Answer 3

I've always done this in XP by going to C:\ in Explorer, right-clicking on the Windows folder, choosing Properties, and looking at the "Created" date.

So long as you're looking at the files from the original installation hard drive (as opposed to a backup that may have been created later), this should be accurate.

Answer 4

Go to C:\Windows\Panther\ and have a look at the date of setupact.log or cbs.log !

That is date and time of the initial installation of Windows.