Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
2,003
Views
Topic starter
07/09/2021 8:11 pm
I am bit of a intermediate into forensics. Wondering where exactly to look at in a windows workstation to see which modem/router (model name) it been connecting to. I am basically looking at where to find the info; event logs and/or tools like ftk/axiom.
Â
Â
08/09/2021 12:54 pm
Check the log "Microsoft-Windows-WLAN-AutoConfig/Operational.evtx" inÂ
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx for Wifi connections.
Wired connections are inÂ
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx
and have the event 10000 as ID
regards, Robin
PS: WiGLE: Wireless Network Mapping once you have the Wifi hotspot names 😉