Question

Summary:
Can i get registry creation, modification, and last write times like i can with files and folders?

Details:
I current have my code setup to display a directory’s 3 time attributes and the same with files. I would love to do this with the registry values that i am searching for as well. is this possible? If so how?

Code sample:
Below are the 3 segments I am using. The Directory and file headings below are just samples from my already working code which does everything i want it to do. I just wanted to show that i know how to get those attributes. The Registry segment is the sanitized code i am using to cycle registry keys (take it and use it if you like ;)) that i wish to add time attributes to in the output.

Directory:

//print out which folders are not whitelisted
string pt = System.String.Concat("\n" + dir, "\n");
Output.AppendText(pt);
DateTime creationTimeUtc = Directory.GetCreationTimeUtc(dir);
DateTime lastWriteTimeUtc = Directory.GetLastWriteTimeUtc(dir);
DateTime lastAccessTimeUtc = Directory.GetLastAccessTimeUtc(dir);
Output.AppendText("creationTimeUtc: " + creationTimeUtc + "\n");
Output.AppendText("lastWriteTimeUtc: " + lastWriteTimeUtc + "\n");
Output.AppendText("lastAccessTimeUtc: " + lastAccessTimeUtc + "\n");

File:

//print out which folders are not whitelisted
string pt = System.String.Concat("\n" + file, "\n");
Output.AppendText(pt);
DateTime creationTimeUtc = File.GetCreationTimeUtc(file);
DateTime lastWriteTimeUtc = File.GetLastWriteTimeUtc(file);
DateTime lastAccessTimeUtc = File.GetLastAccessTimeUtc(file);
Output.AppendText("creationTimeUtc: " + creationTimeUtc + "\n");
Output.AppendText("lastWriteTimeUtc: " + lastWriteTimeUtc + "\n");
Output.AppendText("lastAccessTimeUtc: " + lastAccessTimeUtc + "\n");

Registry:

//check for malware registry values
private void malwareRegCheck()
{
    //lists of registries
    List<string> hkey = new List<string>();
    List<string> names = new List<string>();
    //try
    try
    {
        // Open HKEY_USERS
        // on a remote computer.
        string remoteName = host;
        RegistryKey environmentKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, remoteName);
        //put all hkey_user entries in list
        foreach (string subKeyName in environmentKey.GetSubKeyNames())
        {
            //add SID to hkey list
            hkey.Add(subKeyName);
        }
        //go through the list and enumerate each one
        foreach (string sid in hkey)
        {
            //get the subkeys of each SID under hkey
            RegistryKey sids = RegistryKey.OpenRemoteBaseKey(RegistryHive.Users, remoteName).OpenSubKey(sid);
            //for each id under hkey
            foreach (string id in sids.GetSubKeyNames())
            {
                //create SID path and add to names list
                string SIDpath = sid + "\\" + id;
                names.Add(SIDpath);
            }

        }
        // Close the registry key.
        environmentKey.Close();
        //check if reg entry is whitelisted
        foreach (string fname in names)
        {
            //create path to check
            String fullPath = "\\\\" + host + "\\" + fname;
            //split file path in to parts
            string[] folders = fname.Split('\\');
            //get length of array
            int folderlen = folders.Length;
            //folder is last element in array
            string folder = folders[folderlen - 1];
            //if folder is whitelisted
            if ((xmlmalware2reg.Contains(folder)) || (folder.Length > 6))
            {
                //do nothing 
            }
            //if folder is not whitelisted
            else
            {
                //print out which folders are not whitelisted
                string pt = System.String.Concat(fullPath + ", not whitelisted\n");
                Output.AppendText(pt);

            }
        }

    }
    //catch all exceptions
    catch
    {
    }

}

Answer 1

there is no answer for this question. time variables for registry items can not be gathered via this method.