[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
static extern int RegQueryInfoKey(UIntPtr hKey, [Out()]StringBuilder lpClass, ref uint lpcchClass,
IntPtr lpReserved, out uint lpcSubkey, out uint lpcchMaxSubkeyLen,
out uint lpcchMaxClassLen, out uint lpcValues, out uint lpcchMaxValueNameLen,
out uint lpcbMaxValueLen, IntPtr lpSecurityDescriptor, IntPtr lpftLastWriteTime);
Add-Type @'
using Microsoft.Win32.SafeHandles;
using System;
using System.Runtime.InteropServices;
public class API
{
[DllImport("Advapi32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Error)]
public static extern int RegQueryInfoKey(
SafeRegistryHandle hkey,
uint p2,uint p3,uint p4,uint p5,uint p6,
uint p7,uint p8,uint p9,uint p10,uint p11,
ref long lpftLastWriteTime
);
}
'@
[long]$LastWrite = 0
$key = Get-Item 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams'
[API]::RegQueryInfoKey($key.Handle,0,0,0,0,0,0,0,0,0,0,[ref]$LastWrite)
[DateTime]::FromFileTime($LastWrite)