Where do programs store the check against Volume ID (HWID, Volume Serial, etc.)?

[binarylaw]

Originally Posted by chessgod101

I've seen some cases where a trial software relied on the date that its application specific files and/or directories were created as a means to verify the trial period. They simply called GetFileTime to check this.

But the software would still need to record/log the reference timestamp somewhere, either disk or registry, right?

Originally Posted by ionioni

could be stored in many ways, as ADS of some file/dir, in registry, even at sector level, to name a few... ProcMon might be even catching the thing and not be that obvious, since many times we are biased in our search.
post a link to the software?

Ah, that would make sense. What would be a way to detect if this is happening... using something like an API monitor to watch all the API calls it uses, watching for particular ones that have anything to do with writes?

Here's the link:

https://href.li/?http://download.jgsoft.com/acetext/SetupAceTextDemo.exe