Windows Workstation...
 
Notifications
Clear all

Windows Workstation & Router Forensics

2 Posts
2 Users
0 Likes
1,132 Views
dewyjns
(@dewyjns)
Posts: 2
New Member
Topic starter
 

I am bit of a intermediate into forensics. Wondering where exactly to look at in a windows workstation to see which modem/router (model name) it been connecting to. I am basically looking at where to find the info; event logs and/or tools like ftk/axiom.

Β 

Β 

 
Posted : 07/09/2021 8:11 pm
Bunnysniper
(@bunnysniper)
Posts: 257
Reputable Member
 

Check the log "Microsoft-Windows-WLAN-AutoConfig/Operational.evtx" inΒ 
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx for Wifi connections.

Wired connections are inΒ 
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx
and have the event 10000 as ID

regards, Robin

PS: WiGLE: Wireless Network Mapping once you have the Wifi hotspot names πŸ˜‰

 
Posted : 08/09/2021 12:54 pm
Share:
Share to...