A good way to find the installation date of a linux machine is by using the passwd command with the -S option. This option displays account status information. The status information consists of 7 fields according to “man passwd”. The third field gives the date of the last password change. So, by finding the date of the users who never changed their password we can easily assume the installation date.

These users can be system users like, sys, bin, daemon etc.

example:

# passwd -S sys 11/11/2009 0 99999 7 -1 # passwd -S daemon daemon L 11/11/2009 0 99999 7 -1 # passwd -S bin bin L 11/11/2009 0 99999 7 -1