Windows registry question

Is there a way to find out the date a particular registry entry was created?

 

That's a really interesting question.

Most software that I am aware of rely on an earlier "snapshot" to use for a comparison as a means to determine what changes were made.

Problem is, AFAIK, with something like ERUNT, for example, you have to Restore the older registry backup and reboot with that.
Then you can use regedit or something like Registrar Lite to search for the specific entry.

I'm wondering if there is something that will save a copy of the registry, on demand or automatically at specified intervals, in a form that can immediately be opened and examined.

 

I use Everything Search Engine. http://www.voidtools.com/
Example type dll and all dll's will show with their dates. If a registry date was changed/modified I think it won't show the original date but haven't investigated that part.

 

Agreed, Everything Search is a great tool.

I think what dlb is looking for is a way to track or identify the Creation Date of a specific Key or Subkey within the registry.
The individual files will each contain Many entries.

RegScanner won't show you the Creation date, but does allow searching by date Modified.

 

Yup.... however, the "last time modified" date is the next best thing, and in some scenarios may actually be preferred. I'll take a look at RegScanner... any idea if RegScanner will in a preinstall environment? Like when booting to a Barts CD or the UBCD4Win? I suppose I'll have to contact NirSoft (the developer) and ask them.

Thanks for the info everyone!