We are looking for the serial number of a stolen laptop.
We don't have the laptop… but we have a full backup.
Is there a way to retrieve the serial number from this backup ?Is it a generic Windows installation, or a OEM installation? The former is likely to be entirely platform agnostic, the latter may keep information around – probably in any platform-specific utilities installed with the OS. (I have a feeling some Lenovo Thinkpads do, but I've never checked it out.) Best idea is probably to identify another laptop of the same brand and release, and look for its serial number. Don't check just storage areas – start applications (i.e. OEM-specific) and see if any of those report the information. If they do, research where it comes from, and how it is stored.
It's OEM from Asustek.
I'll check your idea )
Thanks !
PS Still, I wonder why Microsoft keeps the Serial Number so secret…
Thanks for your answer.
Mac address is a good idea. RegRipper gave it withoutany trouble.The thing is, if the cops find the computer where we think it is, they will only look at the backside of the laptop to see if the serial number matches what we gave them.
But the Mac address is better than nothing )
Thanks again.
You may get lucky and find that the MAC address is also on a sticker on the underside of the laptop.
Failing that and assuming that the MAC address you have is the one for the wireless card, there may be a compartment on the underside of the laptop that stores the wireless card. If the police unscrew that compartment the wireless card may have a sticker with the MAC address on it.
PS Still, I wonder why Microsoft keeps the Serial Number so secret…
I guess its because the serial number of the machine would need to be exposed by the hardware in standardised place so that the operating system can record it. Also why would M$ be interested in the serial number of the machine itself?
Having said that I have never looked for a serial number of a machine - providing it isn't encrypted it should be easy enough to take an image of a machine for which you have the s/n and search for it to see if it occurs anywhere.
The MAC address may be your best bet - this is stored in lots of places, but there is good reason for that )
PS Still, I wonder why Microsoft keeps the Serial Number so secret…
I guess its because the serial number of the machine would need to be exposed by the hardware in standardised place so that the operating system can record it. Also why would M$ be interested in the serial number of the machine itself?
Having said that I have never looked for a serial number of a machine - providing it isn't encrypted it should be easy enough to take an image of a machine for which you have the s/n and search for it to see if it occurs anywhere.
The MAC address may be your best bet - this is stored in lots of places, but there is good reason for that )
Well, they could log it for licence tracking. And to help us, poor forensics slaves )
Since it is easy to use the wmic bios get serialnumber command to get the serial number, I thought they would log it somewhere…
Great idea to image a known computer and search for known serial number into it.
I'll give it a try and keep you posted.
Thanks.
I actually did an Asus product registration about a year ago, it was on a motherboard, not a laptop, but i think the registration is probably the same for all computer products. The Asus registration program is called "Asus Product Register Program;" in my particular system the program was found in C/Program Files (x86)\ASUS\APRP. APRP being an acronym for the full program name. I personally did not find anything about my motherboard's serial number in mine, but you may have better luck for laptop. I have a faint memory of not having to type my serial number when registering my motherboard (aka they probably had some way of getting it from the hardware and you just needed your name and email), but it could just be me imagining this too. Lastly, the registration file of ASUS turned out to just be an exe to an internet shortcut, you might have to take out your internet forensics tool out and hope that history and cache has not been freed yet.
As for to your question why Microsoft keeps the serial number such a secret, I'm still wondering why they keep the NTFS file structure such a secret from us. D
if the OS IS WINDOWS 8.1, if i remember correctly, there are also chances that the license of the OS leaves traces in the secureboot or UEFI itself.
especially for OEM installations, now the serial number for the license is stored in the machine hardware itself, and not written anywhere on paper.
i think you can find the license key on the operating system backup and eventually match it with the one found in the UEFI.
Quick update We finally found the serial number…
…on a warranty card sticker in a desk drawer…
Yeah, I know - no forensic glory there.
roll
Cheers.
Wag.
Quick update We finally found the serial number…
…on a warranty card sticker in a desk drawer…Yeah, I know - no forensic glory there.
rollCheers.
Wag.
Well, it would be IMHO "standard" forensics practice as well, if it was the first one on the left, I mean. wink
jaclaz