Get last access date of desktop shortcut

[yxq]

Hello,
The XP Desktop clean wizard can get the last access time of desktop
shortcut, i found that the info come from

"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count"

The valuename and value are encrypted using ROT13, the function below can
decrypt them

*************************************************************
'Encodes text using the ROT13 algorithm
Public Function ROT13Encode(ByVal InputText As String) As String
Dim i As Integer
Dim CurrentCharacter As Char
Dim CurrentCharacterCode As Integer
Dim EncodedText As String = ""

'Iterate through the length of the input parameter
For i = 0 To InputText.Length - 1
'Convert the current character to a char
CurrentCharacter =
System.Convert.ToChar(InputText.Substring(i, 1))

'Get the character code of the current character
CurrentCharacterCode =
Microsoft.VisualBasic.Asc(CurrentCharacter)

'Modify the character code of the character, - this
'so that "a" becomes "n", "z" becomes "m", "N" becomes "Y"
and so on
If CurrentCharacterCode >= 97 And CurrentCharacterCode <=
109 Then
CurrentCharacterCode = CurrentCharacterCode + 13

Else
If CurrentCharacterCode >= 110 And CurrentCharacterCode
<= 122 Then
CurrentCharacterCode = CurrentCharacterCode - 13

Else
If CurrentCharacterCode >= 65 And
CurrentCharacterCode <= 77 Then
CurrentCharacterCode = CurrentCharacterCode + 13

Else
If CurrentCharacterCode >= 78 And
CurrentCharacterCode <= 90 Then
CurrentCharacterCode =
CurrentCharacterCode - 13
End If
End If
End If 'Add the current character to the string to be
returned
End If
EncodedText = EncodedText +
Microsoft.VisualBasic.ChrW(CurrentCharacterCode)
Next i

Return EncodedText
End Function 'ROT13Encode
***********************************************

The 16 byte Binary value will store the last access date and time, can
anyone know how to recover the bianry value to date?

Thank you

 

[OHM \( Terry Burns \)]

Are you asking for a method of directly translating the binary stored valued
direct to a Datestring using the Framework with vb.net?

If you are I dont ever remember seeing this functionality anywhere. It is
highly likely though that if you search MSDN and find the Windows API, that
you will find an API that you can use in your code to simplify what you are
doing.

Someone else may have an alternative answer

OHM ( Terry Burns )

http://TrainingOn.net

 

[Mattias Sjögren]

The 16 byte Binary value will store the last access date and time, can

anyone know how to recover the bianry value to date?

Looks like you should interpret the last 8 bytes as a FILETIME
structure.



Mattias

 

[yxq]

Yes, it is a 8 bytes filetime structure.
I found a sample to get lastshutdowntime, it will get the 8 bytes binary
value.
But it is VB6 and use the RegQueryValueEx function.

If i have 8 bytes binary value, how to convert it to date and time using
VB.Net?
I dont know the relation of 8 bytes and Date.

Thank you

Option Explicit
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Copyright ?1996-2005 VBnet, Randy Birch, All Rights Reserved.
' Some pages may also contain other copyrights by the author.
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Distribution: You can freely use this code in your own
' applications, but you may not reproduce
' or publish this code on any web site,
' online service, or distribute as source
' on any media without express permission.
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Const MAX_COMPUTERNAME As Long = 16
Private Const REG_BINARY As Long = &H3
Private Const HKEY_LOCAL_MACHINE = &H80000002
Private Const ERROR_SUCCESS As Long = 0
Private Const STANDARD_RIGHTS_READ As Long = &H20000
Private Const KEY_QUERY_VALUE As Long = &H1
Private Const KEY_ENUMERATE_SUB_KEYS As Long = &H8
Private Const KEY_NOTIFY As Long = &H10
Private Const SYNCHRONIZE As Long = &H100000
Private Const KEY_READ As Long = ((STANDARD_RIGHTS_READ Or _
KEY_QUERY_VALUE Or _
KEY_ENUMERATE_SUB_KEYS Or _
KEY_NOTIFY) And _
(Not SYNCHRONIZE))
Private Type SYSTEMTIME
wYear As Integer
wMonth As Integer
wDayOfWeek As Integer
wDay As Integer
wHour As Integer
wMinute As Integer
wSecond As Integer
wMilliseconds As Integer
End Type

Private Type FILETIME
dwLowDateTime As Long
dwHighDateTime As Long
End Type

Private Type TIME_ZONE_INFORMATION
Bias As Long
StandardName(0 To 63) As Byte
StandardDate As SYSTEMTIME
StandardBias As Long
DaylightName(0 To 63) As Byte
DaylightDate As SYSTEMTIME
DaylightBias As Long
End Type


Private Declare Function GetTimeZoneInformation Lib "kernel32" _
(lpTimeZoneInformation As TIME_ZONE_INFORMATION) As Long

Private Declare Function SystemTimeToTzSpecificLocalTime Lib "kernel32" _
(lpTimeZone As TIME_ZONE_INFORMATION, _
lpUniversalTime As SYSTEMTIME, _
lpLocalTime As SYSTEMTIME) As Long

Private Declare Function FileTimeToSystemTime Lib "kernel32" _
(lpFileTime As FILETIME, _
lpSystemTime As SYSTEMTIME) As Long

Private Declare Function RegOpenKeyEx Lib "advapi32.dll" _
Alias "RegOpenKeyExA" _
(ByVal hKey As Long, _
ByVal lpSubKey As String, _
ByVal ulOptions As Long, _
ByVal samDesired As Long, _
phkResult As Long) As Long

Private Declare Function RegQueryValueEx Lib "advapi32.dll" _
Alias "RegQueryValueExA" _
(ByVal hKey As Long, _
ByVal lpValueName As String, _
ByVal lpReserved As Long, _
lpType As Long, _
lpData As Any, _
lpcbData As Long) As Long

Private Declare Function RegCloseKey Lib "advapi32.dll" _
(ByVal hKey As Long) As Long

Private Declare Function lstrlenW Lib "kernel32" _
(ByVal lpString As Long) As Long



Private Sub Form_Load()

Command1.Caption = "Last Shutdown Date"
Check1.Caption = "Include time"
Text1.Text = ""

End Sub


Private Sub Command1_Click()

Dim buff As String
Dim bIncludeTime As Boolean

bIncludeTime = Check1.Value = vbChecked
buff = GetLastSystemShutdown(bIncludeTime)
Text1.Text = buff

End Sub


Private Function GetLastSystemShutdown(bIncludeTime As Boolean) As String

Dim hKey As Long
Dim sKey As String
Dim sValueName As String
Dim ft As FILETIME 'value to retrieve
Dim cbData As Long 'size of data

sKey = "System\CurrentControlSet\Control\Windows"
sValueName = "ShutdownTime"

If RegOpenKeyEx(HKEY_LOCAL_MACHINE, _
sKey, _
0&, _
KEY_READ, _
hKey) = ERROR_SUCCESS Then

If hKey <> 0 Then

'retrieve the passed value if present
cbData = Len(ft)
If RegQueryValueEx(hKey, _
sValueName, _
0&, _
REG_BINARY, _
ft, _
cbData) = ERROR_SUCCESS Then

GetLastSystemShutdown = GetFileToSystemDate(ft, bIncludeTime)

End If 'RegQueryValueEx

'clean-up
RegCloseKey hKey

End If 'hKey
End If 'RegOpenKeyEx

End Function


Private Function GetFileToSystemDate(ft As FILETIME, _
Optional bIncludeTime As Boolean =
False) As String

Dim buff As String
Dim st As SYSTEMTIME 'system (UNC) time
Dim lt As SYSTEMTIME 'local time
Dim tz As TIME_ZONE_INFORMATION

If FileTimeToSystemTime(ft, st) Then

'retrieve the local time zone info
GetTimeZoneInformation tz

'convert the system time returned above
'to a local time taking the time zone
'info into account
SystemTimeToTzSpecificLocalTime tz, st, lt

'now just write it out
buff = Format$(DateSerial(lt.wYear, lt.wMonth, lt.wDay), "Long Date")

If bIncludeTime Then

buff = buff & " @ " & Format$(TimeSerial(lt.wHour, _
lt.wMinute, _
lt.wSecond), _
"Long Time")
End If

GetFileToSystemDate = buff

Else
GetFileToSystemDate = ""
End If

End Function