Solved

Determine volume creation datatime?

Posted on 2010-11-24
13
664 Views
Last Modified: 2013-11-17
Hello,

In our application, we need to determine when a volume was created.  I thought that this would be easy to determine by calling Win32's GetVolumeInformationW(), but to my amazement, it does not include this data.  Is there another function that I can call to get it or is there some low-level way that I can get it?  We use C++/CLI and C#, so low-level code doesn't scare me! ;)

Thanks,

Mike
0
Comment
Question by:mjgardne
  • 7
  • 6
13 Comments
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34210906
http://www.integriography.com/
analyzeMFT - a Python tool to deconstruct the Windows NTFS $MFT file

I had two other links but lost them

Google search resulting in this hit:
http://www.google.com/search?q=windows+determine+volume+creation+date&hl=en&ei=iQfuTO0ujOSxA-3BxJ8L&start=20&sa=N
0
 

Author Comment

by:mjgardne
ID: 34211929
Hello WalkaboutTigger,

Before I posted here, I did extensive searches in Google, like yours, and did not find anything...  I looked at the info that you provided about the $MFT file, but I didn't see anything about the volume's creation date.  Could you please point it out to me?  I looked in my NTFS references at the MFT and didn't see anything that would be helpful.

Happy Thanksgiving!
Mike
0
 

Author Comment

by:mjgardne
ID: 34215003
Hmmmm...  It seems that the closest I can get to an answer of when the volume was created is by examining one of the following WMI functions.  I am a little surprised that the volume creation date (when it was formatted) was not in the results from GetVolumeInformation().  If there aren't any other ideas, I will make due with what I have found.

Win32_LogicalDisk
InstallDate
Data type: datetime
Access type: Read-only
Date and time the object was installed. This property does not require a value to indicate that the object is installed.

Win32_Volume Class
InstallDate
Data type: datetime
Access type: Read-only
Indicates when the object was installed. A lack of a value does not indicate that the object is not installed.
0
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34216442
Look at the "Sample Output" section and read through the comma-delimited header.  You're looking for

"Std Info Creation date"

and in the output, it is listed as

"2009/12/27 18:35:57.625000"

Also, have you looked at
http://www.ntfs.com/ntfs-system-files.htm
 or
http://www.ntfs.com/ntfs-partition-boot-sector.htm
 or
http://42llc.net/index.php?option=com_myblog&task=tag&category=Windows&Itemid=39
(some interesting discussions on forensics and volumes)


I don't know if this discussion is useful to you
http://www.sepago.de/helge/2009/09/24/how-to-determine-the-windows-installation-date-with-and-without-powershell/
but it talks about how to determine when Windows was installed.

Is there a specific reason you're looking for volume creation date?
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34216511
Also look at

http://windowsir.blogspot.com/2009_05_01_archive.html

and search for

volume creation date

in the page.
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34216585
If it is a Windows XP system, it appears, based on some rudimentary experimentation, that the volume creation date coincides with the "System Volume Information" directory creation date.
0
 

Author Comment

by:mjgardne
ID: 34220538
Hi WalkaboutTigger,

Well, I tried to use the InstallDate from WMI and it seems to always return null, but the other information from the volume is correct...  So, my idea is a no-go...  I am not in the office right now, but I will look over your suggestions tomorrow.  

The reason that we would like the volume's creation date is that it we need to have a unique key to reference any volumes that might be seen by our application.  From my research, a volume's serial number is not guaranteed to be unique throughout the world, so my idea was to combine the serial number with the volume's creation date.  This would tremendously reduce the possibility of a key collision.  On another note, it floors me that this DateTime is not readily available! :P!

Anyway, thank you for your research and ideas...  I will follow up with you soon!

Have a great holiday!
Mike
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34220745
How about this - volume serial number and the creation time/date stamp of the Windows, Program Files and  Recycler directory?  This way you have 4 pieces of data that, combined, should have a fairly low collision rate, at least for Windows boot volumes.  If you need something more generic, let me know.

I presume you're trying to identify the drive and not the computer, correct?
0
 

Author Comment

by:mjgardne
ID: 34223263
Hmmm... Good ideas, but...  They assume that the volume on the hard disk has Windows installed on it...  Some volumes that we will process will only contain data.  I am thinking about combining the physial hard drive's serial number with the volume serial number.  This would be guaranteed to be unique...  What do you think?
0
 
LVL 15

Accepted Solution

by:
WalkaboutTigger earned 500 total points
ID: 34223511
The likelihood of collisions using those two values should be infintesimal.
0
 

Author Comment

by:mjgardne
ID: 34235448
I agree...  As strange as it sounds, I've been meaning to create a function to grab the serial number from USB/SATA/IDE hard drives, so this is a good reason to do it!  In the end, using the hard drive's serial number with the volume's serial number is a much better key than using the formatting date.

Thanks for your help!

Mike
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34235486
Just realize the low-level calls for reading USB memory sticks may not provide consistent results.  Please test it extensively with a variety of thumb drives prior to blessing it for production.
0
 

Author Comment

by:mjgardne
ID: 34237672
Yup...   I have read many tales of woe from others trying to get serial numbers from flashdisks...  It will be rare that a user would want to use a flashdisk with our application, but if they do and we cannot determine a hardware serial number, the volume serial number should suffice.  In truth, the risk of collision with two drives having the same volume serial number is quite small.

Over the last few days, I've written about 1/2 of the IOCTL and Setup API code to extract the serial number from a SATA/IDE/USB hard drive...  In the near future, I will need to write similar code to extract S.M.A.R.T. information, too.  I am not looking forward to the latter task because the data varies from manufacturer to manufacturer.

Thanks again for your help and advice! :)  

Mike
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Jquery/JSON passing value from one function to another 12 60
VB: Convert 2 dates to specific format 24 53
C# LINQ ForEach() question 6 55
Please explain purpose of GZIP 4 37
This article introduced a TextBox that supports transparent background.   Introduction TextBox is the most widely used control component in GUI design. Most GUI controls do not support transparent background and more or less do not have the…
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question