Does anyone know how I can find what the computer name was from a file on the hard drive? The OS is Windows XP Pro, and I can't find where it's stored. I've looked in the Windows\system32\config folders, and brought System, and Software, into a hex editor, but I couldn't find it. I've also looked under Documents and Settings for the local Admin account, but I didn't see anything in there either.
Any ideas?
Thanks,
John
The problem is that you're trying to open the raw Registry files (which are the right place to look) in a hex editor, when you don't know what you're looking at (I'm not trying to be mean, just kind of pointing out the obvious, I guess).
Either import the System file into RegEdit, or get the Registry Viewer from AccessData. I wrote a tool you can use, but it's probably not something you'd want to use.
Naviagte to the following where you will retrieve the Computer Name and Volume Serial Number.
NTUSER $$$PROTO.HIV\Software\Microsoft\Windows Media\WMSDK\General
From the System Hive
HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName
Networking information
HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
You would be better to view with an offline registry viewer.
The demo of Accessdata Registry Viewer is here
http//
I have used software called RegdatXP in the past for NT hives.
Also, you will find the machine name embedded within link files.
Or, if you don't want do have to deal with a demo version, try the ParseWin32Registry Perl module…it's free, and remains free, regardless of how many files you open.
Computer name is also included in XML files in this directory %WINDIR%\pchealth\helpctr\DataColl