1

I had a Windows 10 laptop which is missing or got stolen, and I'm trying to locate it by scanning for its wifi MAC address.

Unfortunately it was not allocated a static IP address in my network, so I don't have a record of its wireless interface MAC address.

I have a recent clone of its HDD and could get the gigabit ethernet MAC from the registry by using this method. For some reason, however, the wireless interfaces are missing the required BIMacAdddress_* registry keys.

Is there a way to find the wireless network interface MAC from the HDD contents? I also have the hiberfil.sys hibernation file so I could (theoretically) access the laptop's memory contents.

4
  • You suspect it's still being used on the same network? How big is the network? Couldn't you use some other form of elimination? – Tetsujin Jan 21 '19 at 8:01
  • I suspect it's active in the neighbourhood but not connecting to my network, that's why I need to find the MAC address, to passively scan for it. If it connects to my network it'll be easily spotted because I've set up traps to find unusual DHCP clients. – André Fernandes Jan 21 '19 at 14:34
  • The reason you were unable to locate the BIMacAdddress_h and BIMacAdddress_l fields in the salvaged Windows registry of your lost laptop is because your laptop did not have an "Atheros L1 Gigabit Ethernet adapter". Your laptop was eqquiped with an "Intel(R) WiFi Link 1000 BGN". The only place on all of Web that I have come across... that mentions BIMacAdddress_h and BIMacAddress_l as a possible method for retrieving the MAC address from the registry is the SU question you linked to above. I made some meaningful comments to that question that you may find useful. – Samir Oct 1 '19 at 21:16
  • I sincerely hope that you were able to recover your laptop! Let me just add here that it's not a terrible idea actually to keep an inventory list of your network equipment. I do that, and it saves me the hassle of having to unplug and turn things over in order to read the label at the back or bottom when I need to know the MAC, SN, PN or whatever. – Samir Oct 1 '19 at 21:25
1

I managed to find the MAC address in the system event logs.

I fetched the contents of %SystemRoot%\System32\winevt\Logs\ from the HDD clone and opened the Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx file in another Windows 10 PC.

Within that log, there are events with Task Category MsmSecurity which contain the interface MAC address.

Example:

Wireless security started.

Network Adapter: Intel(R) WiFi Link 1000 BGN
Interface GUID: {...}
Local MAC Address: xx:xx:xx:xx:xx:xx
Network SSID: yyyyyyy
BSS Type: Infrastructure
Peer MAC Address: xx:xx:xx:xx:xx:xx
Authentication: WPA2-Personal
Encryption: AES
FIPS Mode: Disabled
802.1x Enabled: No

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.