c# how to determine bios date change

Question

Hello how can i determine with a program (c#) if the Bios Date has Change ?

UPDATED

i'm looking for the machine date, because I want write program that check if some body change that value, figure this out i hava a transaction file that record some info with date and time, and for the registration of this values i have a due time and if some body stop the machine before that due time and wait until the time after the due time to change the bios datetime back and then place the records with that time, i want to know that.

Answer 1

I agree with Danut, even in the unlikely event of it being possible to detect a change based on the bios date, unless you can control the type of bios that each machine uses, it would be pretty likely that a workaround would crop up.

You really have two main routes you can take to solving this issue, either a Hardware or Software approach or a combination of both.

Hardware Approach

Depending on your budget, you could look at implementing a dongle or hard key lock approach - decivces such as Safenet Alladin Keylock have built in timers that are designed for security, that you could tie your software into. The downside would be that each system would need to be linked to a dongle, which has a added overhead cost - however end user tampering would be very unlikely.

Software Approach

Keeping in mind, that there will always be a workaround, you could add a fair amount of soft logic to detect if tampering had occured to the system, i.e. storing the last date the system was activated and comparing it to the current date, comparing the total time the system had been run vs the maximum total time based on the install date vs current date... etc.

However with this approach you may only detect tampering after it has occured, which could mean the validity of some of the data captured between the date that tampering occured and the date that tampering actually was detected could be compromised.

In the end it really comes down to a question of budget and how much your client is willing to pay to ensure that tampering does not occur.

Answer 2

I suggest you obtain BIOS information via WMI, using the Win32_BIOS class. One of the fields that you can query is the BIOS install date (I assume you refer to that date). You can track that piece of data and check if it changes.

Details on using WMI from .NET can be found here.

Answer 3

What you are looking for is theoretically not possible. If someone shuts down a machine, waits 10 days, then sets the clock back on it to 9 days earlier, there is no way to detect that by looking at the BIOS or clock.

However, if your users will be connected to the Internet, you can always get the real time online. And keep in mind, unless the user is extra careful, most Windows installations out there auto-update the clock online too.