📎 AI Summary:
The thread discusses how to locate current IP addresses stored on a Windows 10 machine for forensic purposes. The original poster asks for the file path to find this information, and responders clarify that there isn't a specific file but suggest checking the Windows Registry, particularly under the Interfaces key in SYSTEM hive. Additional tips include referencing the current control set and matching interface GUIDs to network card names, with the overall tone being helpful and informative.
C

Cmann

New Member
Member details
Joined
Jan 26, 2020
Messages
14
Thread Author #1
What is the file path to find out the current IP Addresses stored within a Windows 10 machine? I’m using Autopsy for practice purposes
 

Solution
Neemobeer
You can find them in the registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces
You'll have to figure out which GUID is the correct interface.
Sort by date Sort by votes
C

Cmann

New Member
Member details
Joined
Jan 26, 2020
Messages
14
Thread Author #3
I said I’m using Autopsy, I’ve done a forensic image of the Windows 10 machine but want to know (if there is) a file path location of the current IP Addresses
 
Upvote 0 Downvote
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
#5
You can find them in the registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces
You'll have to figure out which GUID is the correct interface.
 
Upvote 1 Downvote
Solution
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
#8
If you need to know the interface name you can tie the interface GUID to the servicename value under here HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\NetworkCard#
 
Upvote 0 Downvote
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
#10
The other post should be CurrentControlSet and not necessarily ControlSet001.

You have to look at HKEY_LOCAL_MACHINE\SYSTEM\Select Value : Current to see which control set is the active one.
 
Upvote 0 Downvote
You must log in or register to reply here.