Introduction
Determining when a Windows 11 operating system was installed is a common requirement during digital forensic investigations. Investigators may need to establish timelines relating to user activity, malware infections, insider threats, system rebuilds, or evidence preservation.
The installation date of Windows 11 can provide critical context when correlating events across multiple data sources.
Unlike earlier versions of Windows, modern Windows 11 installations generate numerous artefacts across the file system, registry, event logs, setup logs, and recovery infrastructure.
No single artefact should be relied upon in isolation. Instead, forensic practitioners should correlate multiple independent sources to establish a defensible installation timeline.
This article examines the most significant forensic artefacts that can be used to determine when Windows 11 was installed and discusses their evidential value and limitations.
Understanding Windows 11 Installation Scenarios
Before examining artefacts, investigators should determine which installation scenario occurred:
- Clean installation
- In-place upgrade from Windows 10
- System reset (“Reset this PC”)
- Feature update installation
- Deployment from an enterprise image
- Virtual machine provisioning
Each scenario leaves slightly different forensic traces.
Registry Artefacts
SOFTWARE Hive Installation Date
One of the most commonly referenced artefacts is the Windows installation timestamp stored within the SOFTWARE registry hive.
Location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Value: InstallDate
The InstallDate value is stored as a Unix epoch timestamp.
Example: InstallDate = 1738105200
Converted to UTC: 2025-01-28 13:00:00 UTC
Forensic Significance
The InstallDate value often reflects the original operating system installation date.
Limitations
Investigators should note:
- Can survive feature upgrades.
- May not change after major Windows updates.
- Can be modified by administrators.
- Enterprise imaging may produce misleading dates.
Therefore, it should be corroborated with additional artefacts.
BuildLab and BuildLabEx
Located in the same registry key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Relevant values include:
- BuildLab
- BuildLabEx
- CurrentBuild
- DisplayVersion
These values identify:
- Windows build number
- Build compilation information
- Installed feature release
Investigators can determine whether the operating system was installed as Windows 11 or upgraded from an earlier release.
SYSTEM Hive Creation Time
The SYSTEM registry hive itself possesses metadata that may assist in identifying installation timing.
File Location
C:\Windows\System32\Config\SYSTEM
The creation timestamp may closely correspond to the installation process.
Forensic Significance
During a clean installation:
- Registry hives are created during setup.
- Hive creation times frequently reflect installation activity.
Limitations
Creation times may change following:
- System migration
- Backup restoration
- Imaging processes
- Timestamp manipulation
Windows Setup Event Logs
Event logs often provide some of the strongest evidence of installation activity.
Setup.evtx
Location: C:\Windows\System32\Winevt\Logs\Setup.evtx
This log records:
- Operating system installation
- Upgrades
- Component servicing
- Deployment actions
Important Event IDs
Common setup-related events include:
Event ID Description
1 Setup initialization
2 Setup completion
19 Windows update installation
1001 Installation status
1006 Setup success
Investigators can often identify precise installation start and completion times.
Panther Installation Logs
One of the most valuable forensic sources is the Panther directory.
Location: C:\Windows\Panther
Common files include:
- setupact.log
- setuperr.log
- UnattendGC
Setupact.log
The file: setupact.log
contains detailed records of the Windows installation process.
Example entries:
- Starting Setup Platform
- Initializing Setup Engine
- Install completed successfully
Each entry contains timestamps.
Forensic Significance
Provides:
- Installation start time
- Installation progress
- Upgrade details
- Installation completion time
Often represents the most authoritative installation timeline available.
Windows.old Folder Analysis
Following upgrades or reinstalls, Windows may create C:\Windows.old
Evidence Available
The folder can reveal:
- Previous operating system version
- Upgrade date
- User migration activities
Creation timestamps frequently correspond with upgrade installations.
Timeline Value
A Windows.old creation timestamp can help establish when a Windows 10 system transitioned to Windows 11.
File System Artefacts
Windows Directory Creation
Location: C:\Windows
Creation timestamps may indicate installation timing.
Important Caveat
NTFS timestamps can be altered by:
- Imaging
- Cloning
- Backup restoration
- Migration tools
Consequently, they should not be used as sole evidence.
System32 Directory
Location: C:\Windows\System32
Large numbers of files are created during installation.
Investigators often identify:
- Earliest file timestamps
- Installation clusters
- Setup execution windows
Timeline analysis can reveal a concentrated burst of file creation activity.
Event Log Creation Times
The creation dates of primary event logs can be highly useful.
Examples:
- System.evtx
- Security.evtx
- Application.evtx
Location: C:\Windows\System32\Winevt\Logs
Analysis
The first recorded events often occur shortly after installation.
Examples include:
- Kernel initialization
- Service startup
- Driver loading
- Security subsystem creation
These events help establish a minimum installation date.
Restore Points and Shadow Copies
System Restore
Windows 11 automatically generates restore points under certain conditions.
Artefacts may reveal:
- First restore point creation
- Installation-related restore points
- System initialization events
Evidence Sources
Investigators can examine System Volume Information and associated Volume Shadow Copy metadata.
Windows Update Artefacts
Windows installations are commonly followed immediately by updates.
Relevant logs include: WindowsUpdate.log
and event records within: Microsoft-Windows-WindowsUpdateClient
The first update activity often occurs within minutes or hours of installation.
Correlating update timestamps with setup artefacts can strengthen conclusions regarding installation timing.
User Profile Creation Analysis
Windows installations frequently coincide with creation of the first user account.
Investigators should examine: C:\Users
Profile creation timestamps.
Additional artefacts include:
- NTUSER.DAT
- UsrClass.dat
The earliest user profile often appears shortly after operating system deployment.
Timeline Correlation
A typical sequence is:
- Windows installation begins.
- Setup completes.
- First user account created.
- Initial logon occurs.
- Updates are installed.
This sequence can help validate installation findings.
Prefetch Artefacts
Prefetch files may identify setup-related executables.
Location: C:\Windows\Prefetch
Examples:
- SETUPHOST.EXE
- SETUPPREP.EXE
- SETUP.EXE
Prefetch metadata can reveal:
- Execution times
- Run counts
- Installation activity
These artefacts are particularly useful when investigating upgrades.
SRUM and Timeline Analysis
The Windows System Resource Usage Monitor (SRUM) database can provide evidence of early system activity.
Location: C:\Windows\System32\sru\SRUDB.dat
Investigators may correlate:
- First network activity
- Application execution
- User interaction
with installation timestamps.
Forensic Validation Methodology
A defensible forensic conclusion should never rely upon a single artefact.
Best practice is to correlate:
Artefact Reliability
Panther Setup Logs Very High
Setup.evtx Very High
Registry InstallDate Medium
SYSTEM Hive Creation Medium
Windows.old Folder High
User Profile Creation Medium
Event Log Earliest Events High
Restore Points High
Prefetch Records Medium
A timeline generated from multiple independent artefacts provides stronger evidential value and is more resistant to challenges in court.
Example Forensic Timeline
An examiner may identify:
Time (UTC) Event
2026-01-12 09:01:22 setupact.log installation started
2026-01-12 09:38:11 Setup completed
2026-01-12 09:42:08 First user profile created
2026-01-12 09:44:16 First interactive logon
2026-01-12 09:55:03 Windows Update initiated
Together, these artefacts provide compelling evidence that Windows 11 was installed on 12 January 2026.
Conclusion
Identifying when Windows 11 was installed requires examination of multiple forensic artefacts across the registry, event logs, setup logs, file system metadata, restore infrastructure, and user profile data.
While the InstallDate registry value is often cited, the most reliable evidence typically comes from Panther installation logs and Setup event logs.
By correlating these artefacts with file system timestamps, update activity, and user account creation events, investigators can establish a robust and defensible installation timeline suitable for incident response, civil litigation, criminal investigations, and corporate forensic examinations.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
