Windows 10 File path location of IP Addresses

nmsuk

Essential Member

Joined

Sep 7, 2009

Messages

4,329

• Feb 16, 2020

• #2

ipconfig /all from a cmd prompt will grab the ip.

 

Upvote 0 Downvote

C

Cmann

New Member

Joined

Jan 26, 2020

Messages

14

• Feb 16, 2020

• Thread Author
• #3

I said I’m using Autopsy, I’ve done a forensic image of the Windows 10 machine but want to know (if there is) a file path location of the current IP Addresses

 

Upvote 0 Downvote

nmsuk

Essential Member

Joined

Sep 7, 2009

Messages

4,329

• Feb 16, 2020

• #4

Theres not a file path to the IP.

 

Upvote 0 Downvote

Neemobeer

Windows Forum Team

Staff member

Joined

Jul 4, 2015

Messages

8,998

• Feb 16, 2020

• #5

You can find them in the registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces
You'll have to figure out which GUID is the correct interface.

 

Upvote 1 Downvote

Solution

C

Cmann

New Member

Joined

Jan 26, 2020

Messages

14

• Feb 16, 2020

• Thread Author
• #6

Thank you!

 

Upvote 0 Downvote

C

Cmann

New Member

Joined

Jan 26, 2020

Messages

14

• Feb 16, 2020

• Thread Author
• #7

T

 

Upvote 0 Downvote

Neemobeer

Windows Forum Team

Staff member

Joined

Jul 4, 2015

Messages

8,998

• Feb 16, 2020

• #8

If you need to know the interface name you can tie the interface GUID to the servicename value under here HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\NetworkCard#

 

Upvote 0 Downvote

C

Cmann

New Member

Joined

Jan 26, 2020

Messages

14

• Feb 16, 2020

• Thread Author
• #9

Awesome thank you!!

 

Upvote 0 Downvote

Neemobeer

Windows Forum Team

Staff member

Joined

Jul 4, 2015

Messages

8,998

• Feb 16, 2020

• #10

The other post should be CurrentControlSet and not necessarily ControlSet001.

You have to look at HKEY_LOCAL_MACHINE\SYSTEM\Select Value : Current to see which control set is the active one.

 

Upvote 0 Downvote