> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/system-info.md).

# System Info

## System Info in Registry:

### Hostname:

* HKLM\SYSTEM\CurrentControlSet\Control\ComputerName
  * Different ControlSet version could indicate past hostnames.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FMXUqfPJQTMqWV6ByU1Ls%2Fimage.png?alt=media&amp;token=ad157e76-c012-4df2-8e0d-d587f2d4b1ea" alt=""><figcaption></figcaption></figure>

### Build Info and Install Time:

* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FYOdbfPFcz9aG6YYkjrS3%2Fimage.png?alt=media&amp;token=5347ad82-3765-48fc-a3af-3bd9676fc5dc" alt=""><figcaption></figcaption></figure>

### Historical version updates:

* HKLM\SYSTEM\Setup\Source OS

### System Time Zone:

* HKLM\SYSTEM\\\<CurrentControlSet>\Control\TimeZoneInformation

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FXDq3fNRY5OflUcOtVer3%2Fimage.png?alt=media&amp;token=01b4240a-9a59-4714-89e6-bed527ea16ce" alt=""><figcaption></figcaption></figure>

### Network Interfaces:

Track network interfaces in use and their last settings. Shows both physical and virtual interfaces:

* HKLM\SYSTEM\\\<CurrentControlSet>\Services\Tcpip\Parameters\Interfaces

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fi30l3lW8mb9SWDjGrMmO%2Fimage.png?alt=media&amp;token=09704dc0-0a70-4451-9299-eb5ba867a119" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FgMt6wVmxHYO6TFI0eXOd%2Fimage.png?alt=media&amp;token=01a8826b-b8dc-4b44-8fce-a6577c90f550" alt=""><figcaption><p>More details into network interface. </p></figcaption></figure>

### Network Cards:

Track human readable names of network card GUIDs found in interfaces (physical cards only):

* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FYZbngGuHml3LAGxy2OaJ%2Fimage.png?alt=media&amp;token=f35350d9-deda-43a2-9f25-e2b21e58f65d" alt=""><figcaption></figcaption></figure>

### Connected Networks:

* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed (part of AD Domain)
* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged (outside of AD Domain)

Use ProfileGUID in previous key ^ to find first and last time connected to network (timezone stored in 128-bit systemtime - local time):

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FjubU6uNhWZyUeaNzD8t9%2Fimage.png?alt=media&amp;token=eba809c2-d669-4d67-8566-ecb3b3609973" alt=""><figcaption></figcaption></figure>

### Network Names:

* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FAYu61wRpRRU9jSB6fkKN%2Fimage.png?alt=media&amp;token=f3aec872-267e-4c79-bf8c-31dd568d50a2" alt=""><figcaption></figcaption></figure>

### Application Settings:

Audit usage of microphone, webcam, location, and other application specific settings.(windows 64-bit filetime format)

* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore
* NTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore
  * Nonpackaged = Non-Microsoft Apps

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FYMlqE69eAWjglXCHYhzO%2Fimage.png?alt=media&amp;token=059836cf-3127-4384-b6a4-a99cb8cef0cd" alt=""><figcaption></figcaption></figure>

### Shutdown Time:

When a system shutdown (64-bit filetime):

* HKML\SYSTEM\\\<CurrentControlSet>\Control\Windows

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FLCcyeUFOYMkB9GsdSQtq%2Fimage.png?alt=media&amp;token=407b8e47-5b6f-4347-af6f-e9e7711dc6df" alt=""><figcaption></figcaption></figure>