Windows Installation - Where I can change the modification date

[Legolash2o]

It actually shows the creation date. I've been experimenting with this today but everytime it saved, it just reverted itself again

[serg130270]

Cheers and Regards

Edited June 4, 2014 by serg130270

[nonspin]

Try Attribute Changer -> http://www.petges.lu/home/
 
If doesn't work this way, you have to edit the PE_Header or the .xml entry

<LASTMODIFICATIONTIME><HIGHPART>0x01CF6C3D</HIGHPART><LOWPART>0x3FF13CBB</LOWPART></LASTMODIFICATIONTIME>

example:

0x538A7B10 = June, 1st 2014 01:00:00 AM

Edited June 3, 2014 by nonspin

[Legolash2o]

I tried that. Didn't work either

[abbodi1406]

The normal or the official way will be by applying then re-capturing the image (recommended to use vhd to easily delete it later)


 
but you can do it manually by changing the CREATIONTIME of index's xml entry

    <CREATIONTIME>      <HIGHPART>0x01CF7F87</HIGHPART>      <LOWPART>0xD084E5D3</LOWPART>    </CREATIONTIME>

[filter]

@abbodi1406

''but you can do it manually by changing the CREATIONTIME of index's xml entry''

 

Which file is this?

[abbodi1406]

Hex-Edit the wim file itself

 

xml entry will be at the end

[gorgone]

File boot.wim

01CF7F87 wich date format is this ?

unix time ? how its calculated ?

 

there is also multiple positions of creation time !!!

Edited June 4, 2014 by gorgone

[ThuGie]

It does seem to be unix time, simply convert it to decimal and and you will end up with unix time.

[Legolash2o]

You put eh HIGHPART and LOWPART together to make HIGHPARTLOWPART and then convert it to decimal and then some other crap which i'm sure you can google.

[nonspin]

CreationTime is not what you want to edit and expect any results. LastModified or LastModificationTime

is the entry that gets displayed.

Maybe it's just me, but why would you even want to edit it ? It is the one visible information that tells you how old

the image is you are about to install.

[bphlpt]

I think what they are trying to modify is the dates shown like in the images posted by abbodi1406 in this post - http://www.wincert.net/forum/topic/12319-windows-installation-where-i-can-change-the-modification-date/?p=108636, where you are selecting which image to install.  I can see the value of this when you begin to do an install if the date shown is the date the install source image was created.  In other words, if you created one install source in Dec 2013, and another one in June 2014, it would be helpful if those respective creation dates were shown, rather than the RTM date of Win 7 SP1 of 2010 being shown for both install sources such as is shown in the OP of this thread.  The creation date of the modified install source is what really tells you how old the image is you are about to install, not the original RTM date, isn't it?  Or did I misunderstand what you meant?

 

Cheers and Regards

[nonspin]

In that case, why don't you include the ImageSource date in the title (Operating System) ?

.. Or better yet, in the description field displaying after you hightlight the item.

It's also the most promising to actually being editable since the extraction and modifying of the dates isn't that easy.

Then you would have both types of information visible and not confuse anyone - including yourself.

 

Editing the modification date to something only you know the means to isn't of much help or value.

In a perfect world, you would edit the resources of setup and display both items - date created and date modified.

Edited June 6, 2014 by nonspin

[abbodi1406]

CreationTime is not what you want to edit and expect any results. LastModified or LastModificationTime

is the entry that gets displayed.

Maybe it's just me, but why would you even want to edit it ? It is the one visible information that tells you how old

the image is you are about to install.

 

No, CreationTime is the date that get shown on the install screen when you choose between Editions

and as i said, it represent the date when the image (index) was captured for the first time as new

probaply, but when someone update that image with latest updates, tweaks.. etc, he would want the image to have new date

[nonspin]

 

probaply, but when someone update that image with latest updates, tweaks.. etc, he would want the image to have new date

Whenever i add updates it reflects that in showing the date i added them. Hence "date modified"

[abbodi1406]

Of course

 

but at install screen it will show the creation date as last modified date

 

it's just something cosmetic

[nonspin]

ahh, now it makes sense here. Thing is, that i never had issues with the displayed date, because i always apply

a custom boot layer to get my USB3 to work properly. Therefore it never showed the wrong date in the setup.

[nonspin]

Highpart/Lowpart explanation:

 

Highpart: Date

Lowpart: Time

 

convert/verify: w32tm

example:

<CREATIONTIME><HIGHPART>0x01CB88D1</HIGHPART><LOWPART>0xDB7CCA61</LOWPART></CREATIONTIME>

syntax: w32tm /ntte 0xHIGHPARTLOWPART

 

Open DOS-Box: (Win+R) CMD

w32tm /ntte 0x01CB88D1DB7CCA61

149707 16:42:02.2122081 - 11/20/2010 6:42:02 PM

[bphlpt]

Apparently w32tm /ntte displays its results taking into account the local time zone, since for me the time displayed for the above command is 12:42:02 PM instead of 6:42:02 PM.
 
Cheers and Regards

[nonspin]

w32tm /ntte 0x1CF83BD00A67400
151004 08:30:00.0000000 - 6/9/2014 10:30:00 AM

 

151004 08:30:00. <- GMT

...

6/9/2014 10:30:00 AM <- relative to GMT (system setting > GMT+2)

[bphlpt]

For me:
 
w32tm /ntte 0x1CF83BD00A67400
151004 08:30:00.0000000 - 6/9/2014 4:30:00 AM
 
151004 08:30:00. <- GMT
...
6/9/2014 4:30:00 AM <- relative to GMT (system setting > UTC-05:00 Eastern time Zone and Daylight Savings Time is in effect )
 
Is there a switch in w32tm that converts in the other direction?  ie human readable local or GMT to highpart/lowpart?  Looking only very briefly I didn't see one.  Or maybe a different command?  Just curious.
 
EDIT: I did find a discussion here, which includes a PowerShell script here, which looks like it does the job, so maybe there is not an easier way?
 
For convenience the PowerShell script:

# PSDateToInteger8.ps1# PowerShell script demonstrating how to convert a datetime value to the# corresponding Integer8 (64-bit) value. The Integer8 value is the# number of 100-nanosecond intervals (ticks) since 12:00 AM January 1,# 1601, in Coordinated Univeral Time (UTC).## ----------------------------------------------------------------------# Copyright (c) 2011 Richard L. Mueller# Hilltop Lab web site - [url=http://www.rlmueller.net/]http://www.rlmueller.net[/url]# Version 1.0 - March 19, 2011## You have a royalty-free right to use, modify, reproduce, and# distribute this script file in any way you find useful, provided that# you agree that the copyright owner above has no warranty, obligations,# or liability for such use.# Read Datetime value from command line or prompt for value.Param ($strDate)If ($strDate -eq $Null){$strDate = Read-Host "Date (Local Time)"}# Convert string to datetime.$Date = [DateTime]"$strDate"# Correct for daylight savings.If ($Date.IsDaylightSavingTime){$Date = $Date.AddHours(-1)}# Convert the datetime value, in UTC, into the number of ticks since# 12:00 AM January 1, 1601.$Value = ($Date.ToUniversalTime()).Ticks - ([DateTime]"January 1, 1601").Ticks$Value

 
Cheers and Regards

[nonspin]

you mean Date/Time to Integer8?

(remove .txt from attached file)

 

Usage (from CMD)

cscript DateToInteger8.vbs "06/09/2014 10:30:00 PM"

 

result:

Integer8 value: 130468194000000000 (decimal output)

-> use calc.exe (programmer mode) to convert to hex (QWORD)

-> 1CF842195DB5400

 

highpart:01CF8421

lowpart:95DB5400

 

validation: w32tm /ntte 0x1CF842195DB5400

151004 20:30:00.0000000 - 6/9/2014 10:30:00 PM

DateToInteger8.vbs.txt

Edited June 9, 2014 by nonspin

[bphlpt]

Thanks!  

Your solution is obviously from the same guy, of course. LOL  Just his VBS version of his PowerShell solution.
 
Cheers and Regards

[abbodi1406]

Thank you both

Edited June 9, 2014 by abbodi1406

[bphlpt]

By the way, I haven't had a chance to debug it further, but the PowerShell version, which is invoked from a CMD box with: ( assuming it is run from the folder where PSDateToInteger8.ps1 is located )

powershell "& .\PSDateToInteger8.ps1 ""06/09/2014 10:30:00 PM"""

seems to have an issue properly detecting whether Daylight Savings Time is in place(?), because when you try to "validate" the results using w32tm it is off by an hour.  The .VBS version works correctly.

 

Actually I'm not sure which of the functions is correct, but at least the .VBS is consistent with w32tm.  And if you comment out the "Correct for daylight savings." section in the code of the PowerShell version then it gives the same results as the .VBS version.

 

Cheers and Regards