You are right. I just thinked of a pirated version of Adobe Photoshop I once run for years just by keeping the system time basically constant, without changing anything else. Inconsistencies in this "scheme" are easy to check, just create a few "cornermark" files with timestamps. At startup, scan for these files and check if their timestamps are in the past. Of course this can be easy to "hack" from a user perspective, which is why I told this a cat-and-mouse game :-)