Need help with the final piece of the jigsaw

Discussion in 'Windows 7' started by jmoose, Nov 14, 2011.

  1. jmoose

    jmoose MDL Novice

    Oct 25, 2011
    1
    0
    0
    How do i edit or change the "last modified date".

    I have my AIO disk ready but can not seem to get the date changed.

    43y76i9t7c.jpg

    Thanks
     
  2. Stannieman

    Stannieman MDL Guru

    Sep 4, 2009
    2,232
    1,818
    90
    #2 Stannieman, Nov 14, 2011
    Last edited by a moderator: Apr 20, 2017
    It may be that it just reads the timestamps of the file itself. In that case make sure that you have the desired timestamp in your cdimage command. But this is rather unlikely.

    It is more likely that the date inside the wim file itself is used.
    I don't think you can change it with imagex or dism. You can however open the wim with a hex editor. Near the end of the file there is a part that's relatively readable (I think xml).

    In the xml there's a section for each index in the wimfile, each section contains all the properties of the particular index, like name, architecture, edition etc.
    Also the following part is included for each index:
    Code:
    <.C.R.E.A.T.I.O.N.T.I.M.E.>.<.H.I.G.H.P.A.R.T.>.0.x.0.1.C.B.8.9.3.6.<./.H.I.G.H.P.A.R.T.>.<.L.O.W.P.A.R.T.>.0.x.1.3.1.F.3.3.9.A.<./.L.O.W.P.A.R.T.>.<./.C.R.E.A.T.I.O.N.T.I.M.E.>.<.L.A.S.T.M.O.D.I.F.I.C.A.T.I.O.N.T.I.M.E.>.<.H.I.G.H.P.A.R.T.>.0.x.0.1.C.C.8.9.A.A.<./.H.I.G.H.P.A.R.T.>.<.L.O.W.P.A.R.T.>.0.x.6.6.9.C.B.F.3.F.<./.L.O.W.P.A.R.T.>.<./.L.A.S.T.M.O.D.I.F.I.C.A.T.I.O.N.T.I.M.E.>
    The full xml of a wim with 1 index in a neat way:
    Code:
    <WIM>
      <TOTALBYTES>2929667896</TOTALBYTES>
      <IMAGE INDEX="1">
        <DIRCOUNT>14723</DIRCOUNT>
        <FILECOUNT>70280</FILECOUNT>
        <TOTALBYTES>12684703069</TOTALBYTES>
        <CREATIONTIME>
          <HIGHPART>0x01CB8936</HIGHPART>
          <LOWPART>0x131F339A</LOWPART>
        </CREATIONTIME>
        <LASTMODIFICATIONTIME>
          <HIGHPART>0x01CC89AA</HIGHPART>
          <LOWPART>0x669CBF3F</LOWPART>
        </LASTMODIFICATIONTIME>
        <WINDOWS>
          <ARCH>9</ARCH>
          <PRODUCTNAME>Besturingssysteem Microsoft® Windows®</PRODUCTNAME>
          <EDITIONID>Ultimate</EDITIONID>
          <INSTALLATIONTYPE>Client</INSTALLATIONTYPE>
          <HAL>acpiapic</HAL>
          <PRODUCTTYPE>WinNT</PRODUCTTYPE>
          <PRODUCTSUITE>Terminal Server</PRODUCTSUITE>
          <LANGUAGES>
            <LANGUAGE>nl-NL</LANGUAGE>
            <DEFAULT>nl-NL</DEFAULT>
          </LANGUAGES>
          <VERSION>
            <MAJOR>6</MAJOR>
            <MINOR>1</MINOR>
            <BUILD>7601</BUILD>
            <SPBUILD>17651</SPBUILD>
            <SPLEVEL>1</SPLEVEL>
          </VERSION>
          <SYSTEMROOT>WINDOWS</SYSTEMROOT>
        </WINDOWS>
        <NAME>Windows 7 ULTIMATE</NAME>
        <DESCRIPTION>Windows 7 ULTIMATE</DESCRIPTION>
        <FLAGS>Ultimate</FLAGS>
        <HARDLINKBYTES>4837153042</HARDLINKBYTES>
        <DISPLAYNAME>Windows 7 Ultimate</DISPLAYNAME>
        <DISPLAYDESCRIPTION>Windows 7 Ultimate</DISPLAYDESCRIPTION>
      </IMAGE>
    </WIM>
    That looks an awful lot like the times you are looking for. They are formatted in hex. The date can probably be changed by changing those values.
    I don't really know how the date is converted to hex, but I have a suspicion:
    Windows doesn't store time as in hours, minutes, seconds, instead it counts from a start time. So if yesterday was the startday then today would be 1, tomorrow 2 etc.
    I think also when you ask a date in excel it gives you a number, but that's a bit offtopic.
    It could be that the highpart represents the amount of days or hours from that startingtime, and the lowpart is the hours, minutes and seconds counted from the starttime.
    I don't know for sure and I don't know in what exact way it's formatted though. But it doesn't seem to use the same formatting as excel uses.
    So you'll have to google a bit I guess.
    But I'll google with you cause I'm a bit interested in this too actually, but I'm pretty sure that these values are the key to your problem.

    EDIT: Wait a bit, the solution could be closer than we think :)

    PS: Don't just copy over my values from above cause it's a modded wim so they aren't correct either.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Stannieman

    Stannieman MDL Guru

    Sep 4, 2009
    2,232
    1,818
    90
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...