All,
I'm trying to determine what kind of Wireless Security (if any) has been used on a Laptop (OS is WindowsXP) from an Encase Image.
I would need information where in the registry these settings are stored and how to identify if WEP/WPA/WPA2/NONE has been used, if possible for both cases (when Zero Config Service from Windows is used as opposed to the use of the vendor provided Software)
Thank you
Chris
Greetings,
I'm also curious how to go about this via an image.
Would booting the image in a virtual machine with all external access disabled and checking directly work for you?
-David
http//
It's in
HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC\Parameters
Would booting the image in a virtual machine with all external access disabled and checking directly work for you?
I don't think that would work. In a virtual machine there's no Wireless Hardware, so you cant click on Interface->properties …
HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC\Parameters
These settings are only used when the Zero Config Service from windows is used, nothing there when you use the Vendor provided Software.
Hello, everyone!
I've got another question what about Windows Vista? There's no such key (HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC) in Vista.
Where can I find information on Wireless Networks in Windows Vista registry? Should I see it in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wlansvc?
Thanks
I'm also trying to find this information on a vista system, and have no WZCSVC key. The wireless adapter seems to be configured using the Intel ProWireless software, but I still can't find any registry keys/config files which list and SSIDs.
Did anyone ever solve this one?
One way to test this is to install Windows fresh/naked on a system without the wifi card installed (most laptops will allow easy access to the internal wifi card from a cover on the bottom of the system). Use RegShot - http//
For the Vista/Windows 7 wireless info, the key(s) are at
SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles.
For more check out Mark's post on creating a parser for it.
http//
http//
msdn2.microsoft.com/en-us/library/aa916274.aspx It's in
HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC\Parameters
Right, and it's specific to Windows Mobile/Windows CE Embedded.
For the Vista/Windows 7 wireless info, the key(s) are at
SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles.
For more check out Mark's post on creating a parser for it.
http//
cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html
That parser is specific to the date/time data within the values, and not about security settings.