Solved

Determine volume creation datatime?

Posted on 2010-11-24
13
644 Views
Last Modified: 2013-11-17
Hello,

In our application, we need to determine when a volume was created.  I thought that this would be easy to determine by calling Win32's GetVolumeInformationW(), but to my amazement, it does not include this data.  Is there another function that I can call to get it or is there some low-level way that I can get it?  We use C++/CLI and C#, so low-level code doesn't scare me! ;)

Thanks,

Mike
0
Comment
Question by:mjgardne
  • 7
  • 6
13 Comments
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34210906
http://www.integriography.com/
analyzeMFT - a Python tool to deconstruct the Windows NTFS $MFT file

I had two other links but lost them

Google search resulting in this hit:
http://www.google.com/search?q=windows+determine+volume+creation+date&hl=en&ei=iQfuTO0ujOSxA-3BxJ8L&start=20&sa=N
0
 

Author Comment

by:mjgardne
ID: 34211929
Hello WalkaboutTigger,

Before I posted here, I did extensive searches in Google, like yours, and did not find anything...  I looked at the info that you provided about the $MFT file, but I didn't see anything about the volume's creation date.  Could you please point it out to me?  I looked in my NTFS references at the MFT and didn't see anything that would be helpful.

Happy Thanksgiving!
Mike
0
 

Author Comment

by:mjgardne
ID: 34215003
Hmmmm...  It seems that the closest I can get to an answer of when the volume was created is by examining one of the following WMI functions.  I am a little surprised that the volume creation date (when it was formatted) was not in the results from GetVolumeInformation().  If there aren't any other ideas, I will make due with what I have found.

Win32_LogicalDisk
InstallDate
Data type: datetime
Access type: Read-only
Date and time the object was installed. This property does not require a value to indicate that the object is installed.

Win32_Volume Class
InstallDate
Data type: datetime
Access type: Read-only
Indicates when the object was installed. A lack of a value does not indicate that the object is not installed.
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34216442
Look at the "Sample Output" section and read through the comma-delimited header.  You're looking for

"Std Info Creation date"

and in the output, it is listed as

"2009/12/27 18:35:57.625000"

Also, have you looked at
http://www.ntfs.com/ntfs-system-files.htm
 or
http://www.ntfs.com/ntfs-partition-boot-sector.htm
 or
http://42llc.net/index.php?option=com_myblog&task=tag&category=Windows&Itemid=39
(some interesting discussions on forensics and volumes)


I don't know if this discussion is useful to you
http://www.sepago.de/helge/2009/09/24/how-to-determine-the-windows-installation-date-with-and-without-powershell/
but it talks about how to determine when Windows was installed.

Is there a specific reason you're looking for volume creation date?
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34216511
Also look at

http://windowsir.blogspot.com/2009_05_01_archive.html

and search for

volume creation date

in the page.
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34216585
If it is a Windows XP system, it appears, based on some rudimentary experimentation, that the volume creation date coincides with the "System Volume Information" directory creation date.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:mjgardne
ID: 34220538
Hi WalkaboutTigger,

Well, I tried to use the InstallDate from WMI and it seems to always return null, but the other information from the volume is correct...  So, my idea is a no-go...  I am not in the office right now, but I will look over your suggestions tomorrow.  

The reason that we would like the volume's creation date is that it we need to have a unique key to reference any volumes that might be seen by our application.  From my research, a volume's serial number is not guaranteed to be unique throughout the world, so my idea was to combine the serial number with the volume's creation date.  This would tremendously reduce the possibility of a key collision.  On another note, it floors me that this DateTime is not readily available! :P!

Anyway, thank you for your research and ideas...  I will follow up with you soon!

Have a great holiday!
Mike
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34220745
How about this - volume serial number and the creation time/date stamp of the Windows, Program Files and  Recycler directory?  This way you have 4 pieces of data that, combined, should have a fairly low collision rate, at least for Windows boot volumes.  If you need something more generic, let me know.

I presume you're trying to identify the drive and not the computer, correct?
0
 

Author Comment

by:mjgardne
ID: 34223263
Hmmm... Good ideas, but...  They assume that the volume on the hard disk has Windows installed on it...  Some volumes that we will process will only contain data.  I am thinking about combining the physial hard drive's serial number with the volume serial number.  This would be guaranteed to be unique...  What do you think?
0
 
LVL 15

Accepted Solution

by:
WalkaboutTigger earned 500 total points
ID: 34223511
The likelihood of collisions using those two values should be infintesimal.
0
 

Author Comment

by:mjgardne
ID: 34235448
I agree...  As strange as it sounds, I've been meaning to create a function to grab the serial number from USB/SATA/IDE hard drives, so this is a good reason to do it!  In the end, using the hard drive's serial number with the volume's serial number is a much better key than using the formatting date.

Thanks for your help!

Mike
0
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 34235486
Just realize the low-level calls for reading USB memory sticks may not provide consistent results.  Please test it extensively with a variety of thumb drives prior to blessing it for production.
0
 

Author Comment

by:mjgardne
ID: 34237672
Yup...   I have read many tales of woe from others trying to get serial numbers from flashdisks...  It will be rare that a user would want to use a flashdisk with our application, but if they do and we cannot determine a hardware serial number, the volume serial number should suffice.  In truth, the risk of collision with two drives having the same volume serial number is quite small.

Over the last few days, I've written about 1/2 of the IOCTL and Setup API code to extract the serial number from a SATA/IDE/USB hard drive...  In the near future, I will need to write similar code to extract S.M.A.R.T. information, too.  I am not looking forward to the latter task because the data varies from manufacturer to manufacturer.

Thanks again for your help and advice! :)  

Mike
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

It was really hard time for me to get the understanding of Delegates in C#. I went through many websites and articles but I found them very clumsy. After going through those sites, I noted down the points in a easy way so here I am sharing that unde…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now