Last Write Time of value

Content Authoring
1

(imported topic written by MartinWolff)

Hi,

Does the “Last Write Time” inspector allow for returning the last write time of a specific value of a registry key, or just the key itself?

It would seem that the former is true given the following:

Q: last write time of key "HKLM\SOFTWARE\Microsoft\Windows Search" of registry
A: Thu, 14 Nov 2013 10:02:56 -0600

while

Q: last write time of value "DataDirectory" of key "HKLM\SOFTWARE\Microsoft\Windows Search" of registry
E: The operator "last write time" is not defined.

Is it at all possible to return when a registry key value was last modified?

I’m trying to determine when the DataDirectory value of the Windows Search registry key above was last modified (aka Windows Search index location). This is what I have written, but I’d wager that it returns the modification date of the key, not the value.

(names whose (it is "DataDirectory" of it) of value "DataDirectory" of it, (year of it as string & "-" & month of it as two digits & "-" & day_of_month of it as two digits) of date (local time zone) of last write times of it) of key "HKLM\Software\Microsoft\Windows Search" of registry

Cheers,

Martin

PS: the relevance of the analysis includes a check for the existence of the appropriate regkey, which is why I haven’t included an exists statement above

2

(imported comment written by BrianPGreen)

You can only query for the last write time of the key, not of any value. I’m not sure that Windows exposes a way to get at the last write time of a registry key value.

However, it does look like whenever any value in the key is modified, the last write time of the key is updated.