Go Back   Tech Support Forum > Microsoft Support > Windows XP Support

User Tag List

Finding the MAC address for a network card that I don't have anymore

This is a discussion on Finding the MAC address for a network card that I don't have anymore within the Windows XP Support forums, part of the Tech Support Forum category. So here is my odd question. My company had an old Dell PC running XP SP3that has been disposed of.


Closed Thread
 
Thread Tools Search this Thread
Old 12-16-2009, 01:37 PM   #1
Guest
 
Join Date: Dec 2009
Posts: 2
OS:



So here is my odd question. My company had an old Dell PC running XP SP3that has been disposed of. We don't have the hardware, and we don't know the serial number. All that remains of this PC is a Ghost image of the hard drive that was taken before the PC was thrown away. Now it turns out that I need to find out what the machine's MAC address was. There was just one NIC. Is there any way that I can find the machine's MAC address using only the files from that image? Would it exist somewhere in the registry or a log file? I am stumped. Thanks in advance for any suggestions.
ConcreteCharlie is offline  
Sponsored Links
Advertisement
 
Old 12-16-2009, 01:51 PM   #2
Troubled
 
Join Date: Apr 2009
Posts: 2,854
OS:



I Don't know if you can find this in an image but in the image Go to Start/Run and type msinfo32.exe. In System Info on the left panel go to Components/Network/Adapter/MAC address
deleted010511 is offline  
Old 12-16-2009, 03:30 PM   #3
Guest
 
Join Date: Dec 2009
Posts: 2
OS:



Thanks for the reply, spike. I didn't know that I could also get the mac on a running system though MSINFO, so thanks for the tip. Unfortunately that doesn't help with this particular system. Even if I were to load the image on similar hardware, and try any of the methods I know to find the MAC address, it still wouldn't help since I would just be getting the MAC for the current NIC. Looks like I may be out of luck
ConcreteCharlie is offline  
Sponsored Links
Advertisement
 
Old 12-16-2009, 03:40 PM   #4
Enthusiast
 
pat mcgroin's Avatar
 
Join Date: May 2009
Location: Toledo Oh.
Posts: 2,865
OS: Windows 7 Professional x86 :W7 x 64

My System


You are right that is a odd question.
Can I ask why you need the address?
What are you trying to connect to?

There could possibly be a different way to get connected if that is the issue.
pat mcgroin is offline  
Old 12-16-2009, 07:29 PM   #5
Guest
 
Join Date: Aug 2008
Posts: 2,439
OS:



inspired by this article
https://www.windowsreference.com/netw...dows-registry/ (to find the key)

you can probably import the registry from the ghost image. look in Windows\System32\config\system (I think that's the hive file for HKEY_LOCAL_MACHINE). Open the registry editor (start run, regedit)
click on hkey_local_machine (i always forget that damn step then wonder why file, load hive is grayed out - credits to this post for refreshing my memory). click on file, load hive and open the imported system file. give it a name (xyz). It'll be a subkey for HKEY_LOCAL_MACHINE. Navigate it and find this key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}
(i'm presuming there's no "currentcontrolset" since the registry's not from a running windows session)
There'll be a bunch of subkeys. Look at the values in them. They'll be in the format
{8digits-4digits-4digits-4digits-12digits}
the last 12 digits are mac addresses. you'll have to find the right one somehow. for instance on my system, i have a dummy adapter (type getmac at the command prompt, you might get one) and it's in some of the listings too. but some of the keys have the actual mac addresses for my network cards.
if you're lost, just check in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318} (yours, not the imported one), and find your own MAC address (which you can get by typing getmac from the command prompt).

P.S: to get the file, use ghost explorer, then drag and drop just the one file to your desktop - no need to decompress the whole image to an actual drive or partition.
blah789 is offline  
Old 12-16-2009, 07:37 PM   #6
Guest
 
Join Date: Aug 2008
Posts: 2,439
OS:



This might help you pick out which MAC address was originally the right one: first three bytes (6 hexadecimal digits) are the OUI (think of it as manufacturer ID).
For instance I type 00112f in https://standards.ieee.org/regauth/oui/ i get Asus (the manufacturer of my motherboard)
blah789 is offline  
Old 12-17-2009, 02:01 PM   #7
Enthusiast
 
pat mcgroin's Avatar
 
Join Date: May 2009
Location: Toledo Oh.
Posts: 2,865
OS: Windows 7 Professional x86 :W7 x 64

My System


Hey Blah,

That is a fine bit of research.
I had never really thought of getting something singular from a Ghost archive, much less as specific as a registry entry.
pat mcgroin is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 09:47 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts