Windows 10 File path location of IP Addresses

[Cmann]

What is the file path to find out the current IP Addresses stored within a Windows 10 machine? I’m using Autopsy for practice purposes

 

[nmsuk]

ipconfig /all from a cmd prompt will grab the ip.

 

[Cmann]

I said I’m using Autopsy, I’ve done a forensic image of the Windows 10 machine but want to know (if there is) a file path location of the current IP Addresses

 

[nmsuk]

Theres not a file path to the IP.

 

[Neemobeer]

You can find them in the registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces
You'll have to figure out which GUID is the correct interface.

 

[Cmann]

Thank you!

 

[Cmann]

T

 

[Neemobeer]

If you need to know the interface name you can tie the interface GUID to the servicename value under here HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\NetworkCard#

 

[Cmann]

Awesome thank you!!

 

[Neemobeer]

The other post should be CurrentControlSet and not necessarily ControlSet001.

You have to look at HKEY_LOCAL_MACHINE\SYSTEM\Select Value : Current to see which control set is the active one.