Registry key LastWrite time

The LastWrite time is a 64-bit FILETIME stored in the node record of every key in a registry hive. Windows updates it whenever the key itself changes: a value is created, modified or deleted, or a subkey is added or removed directly beneath it. Individual values carry no timestamp of their own, so this is the only per-key clock the Registry offers. It is stored in UTC.

The timestamp tells you when something changed in a key, not what. If a key holds twenty values, the LastWrite time reflects only the most recent edit to any of them. This matters for MRU-style keys such as ShellBags or RecentDocs, where the key's LastWrite time is usually tied to the entry at the top of the MRU list, while older entries have no direct date.

Keep a few pitfalls in mind. Windows updates, installers and background services touch keys constantly, so a recent LastWrite time is not proof of user action. Changes still sitting in the registry transaction logs may not be reflected in the primary hive until the logs are replayed. Finally, the value can be deliberately altered through the native API, a form of timestomping, so corroborate it with other sources from Registry hives and the file system.