Shoutbox

quote:

---

Originally posted by mynetx
Please right-click the Users/[PCUSER]/AppData/Local/Microsoft/Messenger/xyz@hotmail.com folder to see its filesystem creation date.

---

quote:

---

Originally posted by castreyboy
....I have looked in the following directory and it does not appear there

---

The address is apparently only found in the registry, not anywhere else. So, unfortunatly, there isn't an easy way anymore to detect the creation date.

---

castreyboy,

It might be a leftover from someone who had physical access to your PC (and who removed the directories afterwards to cover his tracks) or whatever like mynetx said. But another possebility is that this address has been added to the registry by some program you've used (since it only exist in the registry).

Does that address appear to be a legit normal address (eg: it contains a name or other recognizable words) or is it very cryptic (eg: number and letters)?

-----------------

Anyways, if you're lucky you can check in the registry for some leftover data to check when it was used.

1) Calculate the ID-Hash of the Windows Live ID.
    You can do this using this online calculator

2) Open your registry editor and navigate to:
    HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger\PerPassportSettings\the_ID-Hash_from_step_1

3) Find the DateOfLastHighlightLaunch setting.

This is a hexadecimal number representing a date. To convert this to a decimal number:

4) Open up your Windows Calculator and switch it to 'Scientic Mode'.
    (second menu > Scientific Mode)

5) Click on the 'Hex' button to switch to hexadecimal notation.
    Now enter that hexadecimal number you've found in step 3.
    But enter the bytes backwards!
    eg: if the number is '12 34 56', you enter '563412'
    Click on the 'Dec' button to switch to decimal notation.

Now you have a decimal number representing a date. To convert it to a date:

6) Open up the Command Prompt (Start menu > Run > cmd) and enter the following command:
    w32tm  /ntte  the_decimal_number_from_step_5

What you see now is a date in your local time zone.

-----------------

Another registry setting you can check is:

7) Find the UTT setting. This is an unicode string.
8) Double click on it to see ascii values of the string.

You can also see a date here.

-----------------



Both dates can give you an idea when that Windows Live Id was used to log into Messenger.
They are not realy sign in dates though. But they can give you an idea around what period of time it was used.