To save me some time, does anyone know if the motherboard serial number is stored in the registry anywhere?
Essentially I've got a loose drive, with a modern Windows OS, and suspect it was probably the old main drive used in another chassis I have.
So, ideally I just wanted to compare something like the motherboard serial number, in the registry of the complete computer and this loose drive, to check whether it had previously been the OS drive in that chassis, before being upgraded/discarded.
If not, if there's any other good way to achieve the same thing easily, that would also be good.
Thanks
Should mention I've compared details like the processor information including stepping, which are the same, as an indication, but looking for something a lot nearer to being concrete.
Should have some mobo info stored under:
HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS
Â
Â
Should have some mobo info stored under:
HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS
Â
Â
I would have checked that....if the hardware registry hive was stored as a file on Windows computers 😉Â
Ack you're correct, wasn't thinking there!Â
Did a test on my local machine, wasn't able to locate the exact serial, but found references to the Mobo model under:
Â
HKEY_LOCAL_MACHINE\Software\HardwareConfig
AMCACHE/DEVICEPNPS
Amcache.hve looks useful in case it helps anyone else.
The hive has a DeviceCensus within it which contains lots of info that tallys up nicely (OK lots is an exaggeration but some more mobo/firmware info).
Good enough for my purposes in this case anyway temporarily.
To save me some time, does anyone know if the motherboard serial number is stored in the registry anywhere?
Essentially I've got a loose drive, with a modern Windows OS, and suspect it was probably the old main drive used in another chassis I have.
So, ideally I just wanted to compare something like the motherboard serial number, in the registry of the complete computer and this loose drive, to check whether it had previously been the OS drive in that chassis, before being upgraded/discarded.
If not, if there's any other good way to achieve the same thing easily, that would also be good.
Thanks
Most GUID's generated in Windows are V1, see:
https://www.forensicfocus.com/forums/forensic-software/how-to-check-all-timestamps-of-file/
So you should be able to determine the MAC address of the machine.
jaclaz