Windows Workstation & Router Forensics
I am bit of a intermediate into forensics. Wondering where exactly to look at in a windows workstation to see which modem/router (model name) it been connecting to. I am basically looking at where to find the info; event logs and/or tools like ftk/axiom.
Check the log "Microsoft-Windows-WLAN-AutoConfig/Operational.evtx" in
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx for Wifi connections.
Wired connections are in
and have the event 10000 as ID
PS: WiGLE: Wireless Network Mapping once you have the Wifi hotspot names 😉