Discovering IP Addresses

IP addresses are stored in the registry, which should come as no surprise by now. In fact, you can find not just the current IP address but also recently used IP configurations. They are stored in the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

Under this key, you will find many subkeys that are given GUID names. Under these GUID-named keys you will find various interface configurations for IP addresses that have been configured on the machine. They exist for either static (fixed or assigned by the network administrator) or dynamic (assigned on the fly by a DHCP server) IP addresses. You can determine which type by examining the settings for the interface.

Figure 9-57 ...

Get Mastering Windows Network Forensics and Investigation, 2nd Edition now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.