Thread: registry question

Hi everyone, is there a way to get the created, modified and last accessed dates (or any of these) from registry keys?

Ive had a look at RegQueryInfoKey() and although i don't really understand it, it seems to only give the last write time. Does this mean that created and modifed dates of registry keys cannot be obtained?


thank you

I have placed part of my program below, if searches and finds all the keys stored under the key USBSTOR and stores them into 'buf' temporarily then prints them out. I have tried to use the FILETIME function to find each key's last written time but i seem to be getting a lot of errors with too few parameters in GetFileTime. Am i heading down the right lines with using FILETIME in the registry?


thank you

Code:

    
//below find all the keys stored under the USBSTOR key in variable buf.

    HKEY hKey = 0;
    char buf[255] = {0};
    DWORD dwBufSize = sizeof(buf);

    const char* subkey = "SYSTEM\\CurrentControlSet\\Enum\\USBSTOR";


    if( RegOpenKey(HKEY_LOCAL_MACHINE,subkey,&hKey) == ERROR_SUCCESS)
    {
        int i = 0;
        while(RegEnumKeyEx(hKey, i++, buf, &dwBufSize, 0, 0, 0, 0) == ERROR_SUCCESS)
        {
          cout << "Found Key Value Name: " << buf << endl;
          dwBufSize = sizeof(buf);



//getting the lastwrite time for registry key

FILETIME writetime;
GetFileTime(hKey, &writetime);

SYSTEMTIME st;
FileTimeToSystemTime( &writetime, &st )
                                         cout <<  st.wYear << "/"
					 << st.wDay << "/"					
					 << st.wMonth << " "
					 << st.wHour << ":"
					 << st.wMinute << ":"
					 << st.wSecond << ":"
					 << st.wMilliseconds ;

}

}

ah right, I see, i would like to use the RegQueryInfoKey()

I am a bit stuck as to what to call in the regqueryinfokey though. 'hKey' is the link to HKEY_LOCAL_MACHINE keywhich I have passed. 'buf' contains the subkey name I want to query, but I am unsure as to whether to pass 'buf' or 'buf1' where 'buf1' contains the complete path and name to the registry key I want to query. I have also passed the FILETIME value, but it still asks for more parameters

Code:

FILETIME writeTime;

RegQueryInfoKey(hKey,buf, &writeTime );



SYSTEMTIME st;
FileTimeToSystemTime( &writeTime, &st );
                                         cout <<  st.wYear << "/"
					 << st.wDay << "/"					
					 << st.wMonth << " "
					 << st.wHour << ":"
					 << st.wMinute << ":"
					 << st.wSecond << ":"
					 << st.wMilliseconds ;

cheers, this is my last post on the topic and thank you for your patients and help, I'm appreciating it!

Your advice has got the time and date displaying correctly but I just need to check which key I'm getting the time for as I feel it may be the wrong one as all the times and dates are displaying the same.

When I pass 'hKey' to my program, is that not passing the key HKEY_LOCAL_MACHINE and therefore I am reading the lastwritten time of this key everytime in my loop thats why its the same every time?

As my value 'buf' contains the full path to the key I want to query the lastwritten time, do I need to pass this?

thank you

Code:

  HKEY hKey = 0;
    char buf[255] = {0};
    DWORD dwBufSize = sizeof(buf);
    const char* subkey = "SYSTEM\\CurrentControlSet\\Enum\\USBSTOR";
    string path = "SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\";
	

    if( RegOpenKey(HKEY_LOCAL_MACHINE,subkey,&hKey) == ERROR_SUCCESS)
    {
        int i = 0;
        while(RegEnumKeyEx(hKey, i++, buf, &dwBufSize, 0, 0, 0, 0) == ERROR_SUCCESS)
        {
          cout << "Found Key Value Name: " << buf << endl;
          dwBufSize = sizeof(buf);
		string bufish = buf;
		string nextkey = path +bufish;          
cout << nextkey << endl;
     

FILETIME writeTime;
RegQueryInfoKey(hKey,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,&writeTime);



SYSTEMTIME st;
FileTimeToSystemTime( &writeTime, &st );
                                         cout <<  st.wYear << "/"
					 << st.wDay << "/"					
					 << st.wMonth << " "
					 << st.wHour << ":"
					 << st.wMinute << ":"
					 << st.wSecond << ":"
					 << st.wMilliseconds ;

sorted it, thanks again for the help!