past connected "wired" networks

benjamin78

Beta member
Messages
1
Location
Mississippi
I am trying to find information stored in windows 7 about my past connected 'wired" networks. I connected to a network the day before at a location I was working at troubleshooting some IP cameras...is there a way to retrieve this information, like; ip address i had at the time and default gateway I was connected to at the time? Thanks in advance for any help
 
I know that it is perfectly possible to recover this, but without using expensive digital forensics software I have no idea as to how. I'll do a bit of digging and respond again if I come up with something.

Edit: Okay, it looks like connected networks are permanently saved as profiles within the registry at
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
If the list is fairly short you should be able to go through the list and figure out which one is the one you're after. If there are a lot of them, the profile ID contains the date and time (in Unix format) of the first use of that connection. Both the assigned IP and the gateway IP should be within the set of recorded data.

Source: this whitepaper, roughly pages 7-10
 
Last edited:
^^ Sweet, didn't know about that.

I've only got my work machines at the moment to verify which isn't much use for me (since I have no context as to what they've connected to), but when I get home I'll do a bit more investigating.
 
I've only got my work machines at the moment to verify which isn't much use for me (since I have no context as to what they've connected to), but when I get home I'll do a bit more investigating.

Same here - lol. Didn't seem to show any wifi networks within that list, just possibly wired networks. There were quite a few entries that didn't display any addresses other than a 255.255.255.0 subnet tho either...but not sure if that's just when I was disconnected and had no access or what.
 
Back
Top Bottom