What licence terms apply to the use of RegLast?
This software was developed with the greatest attention to detail. However, the author can not guarantee that it runs under every version of Windows NT or on each computer flawlessly. Use of this program is at your own discretion. The copyright holder provides the program "as is" without warranty of any kind.
RegLast is available only as part of RegTools for Windows NT. You are not allowed to use or distribute it outside the company or organization where it is licensed for!

What are the requirements to use the program successfully?

• Windows NT version 4.0 or above
• You must accept the Licence terms.
• You need "Read" permission for all keys you want to query.
• If you don't have these permissions to a key, but you are a member of the Administrators group, you can query its data as well.

This help screen will pop up when you type RegLast /?:

The help screen of RegLast

RegLast 1.0 - lists or querys Last Write Time for Registry keys  Copyright (c) 2001 Frank Heyne Software (http://www.heysoft.de)  Usage: RegtLast Key Command    Key: [\\computer\]root[\subkey]      \\computer:  remote machine      root: HKLM, HKU, HKCU, HKCC or HKCR      subkey: path to the key you want to query    Query Commands:      /L                 List (show the Last Write Time)      /FAyyyymmddhhnnss  Find all subkeys changed After specified time      /FByyyymmddhhnnss  Find all subkeys changed Before specified time    Other Commands:      -Subtree  apply command to subtree (superfluous with /F)      -ANSI     Use ANSI character set instead of OEM character set      -UTC      Use UTC instead of local time      -DTF      Use Default Time Format for output      -?        This help screen

First you need to provide the following information to RegLast:

1. The full path to the Registry key whose Last Write Time you wish to query.
2. Provide a command for the query to ask to the specified registry key. If no command is specified the program will do (surprise!) nothing.

Specifying a Registry key

[\\Computer\]Root[\Subkey]

Example:[\\PegasusNT1\]HKLM\System\CurrentControlSet\Enum

HKLM - HKEY_LOCAL_MACHINE
HKU  - HKEY_USERS
HKCU - HKEY_CURRENT_USER
HKCC - HKEY_CURRENT_CONFIG
HKCR - HKEY_CLASSES_ROOT

The switch -SUBTREE
With the -SUBTREE switch you tell RegLast to employ the /L command to the specified key and its subtree, instead of just working with the key itself.
 
The switch -UTC
Normally RegLast uses current settings for local time zone information and daylight savings time. With the -UTC switch you tell RegLast to use UTC (Coordinated Universal Time) instead. This is the standard time Windows NT is actually using for saving Registry access times.

The switch -DTF
Normally RegLast uses the format yyyymmddhhnnss (explained with the /FA option below) for displaying the Last Write Time. With the -DTF switch you tell RegLast to use the current Default Time Format for your machine.

Commands

The command /L
With the /L command (List ) you can display the Last Write Time of the key or its entire subtree (in conjunction with the -SUBTREE switch).

The command /FAtime (Find keys After time)
This command returns a list of all keys in the entire subtree with a Last Write Time which is after the time specified.
Independently from the use of the DTF switch, the time must be encoded in the format yyyymmddhhnnss
where

• yyyy is the year with 4 digits
• mm is the month with 2 digits
• dd is the day with 2 digits
• hh is the hour with 2 digits (in 24 hour notion!)
• nn is the minute with 2 digits
• ss is the second with 2 digits

The command /FBtime (Find keys Before time)
This command returns a list of all keys in the entire subtree with a Last Write Time which is before the time specified. You may combine the commands /FA and /FB to narrow down the Last Write Time window at any precision up to a second.

Examples
1. To list all Registry keys under hklm\software which have been changed the last time on 1. June 2001 between 10:00 PM and 10:10 PM, you use the following command:
RegLast hklm\software /fa2001060122 /fb200106012210

2. Compare the results in dependence of the use of the -DTF switch:

Command:
reglast hklm\software\FrankHeyne  /l
Result:
Last write time of Registry key hklm\software\FrankHeyne:
20010601154958  hklm\software\FrankHeyne

Command:
reglast hklm\software\FrankHeyne  /l -dtf
Result:
Last write time of Registry key hklm\software\FrankHeyne:
6/1/2001  3:49:58 PM    hklm\software\FrankHeyne

3. Consider a Windows 2000 machine, where you want to list the Last Write Times for all subkeys beneath hklm\security\Policy\Secrets\
This is part of the output of RegEdt32, when you save the subtree into a text file:
 
Key Name:          SECURITY\Policy\Secrets\SAC
Class Name:
Last Write Time:
 
Key Name:          SECURITY\Policy\Secrets\SAI
Class Name:
Last Write Time:

Not very helpful, isn't it?

And this is part of the output of RegLast:
20000207185208  hklm\security\Policy\Secrets\SAC
20010530183645  hklm\security\Policy\Secrets\SAC\CupdTime
20010530183645  hklm\security\Policy\Secrets\SAC\CurrVal
20010530183645  hklm\security\Policy\Secrets\SAC\OldVal
20010530183645  hklm\security\Policy\Secrets\SAC\OupdTime
20000207185208  hklm\security\Policy\Secrets\SAC\SecDesc
20000207185208  hklm\security\Policy\Secrets\SAI
20010530183645  hklm\security\Policy\Secrets\SAI\CupdTime
20010530183645  hklm\security\Policy\Secrets\SAI\CurrVal

Now what program do you prefer? ;-)

Is everything clear now?
When you have read this document carefully and you still have a question or are vague regarding a topic, you can email to fh@heysoft.de. But please check first the Security FAQ for the Windows NT Registry - your question might be already answered there. If you find errors or would like to contribute knowledge to this document, you are encouraged to email us, too.