# Find host name of user machine

**URL:** <https://sleuthkit.discourse.group/t/find-host-name-of-user-machine/555>\
**Category:** Autopsy Help\
**Created:** [March 19, 2020, 10:44pm UTC](https://sleuthkit.discourse.group/t/find-host-name-of-user-machine/555 "2020-03-19T22:44:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Batrobin67](https://avatars.discourse-cdn.com/v4/letter/b/b5a626/32.png) [@Batrobin67](https://sleuthkit.discourse.group/u/Batrobin67)\
**Post date:** [March 19, 2020, 10:44pm UTC](https://sleuthkit.discourse.group/t/find-host-name-of-user-machine/555/1 "2020-03-19T22:44:21Z")

</div>

I’m trying to find out the host name of the user machine from an image. However, no Operating System Information folder is located under Extracted Content… Where am I able to find out the host name of the user machine?

---

<div class="post-metadata">

**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\
**Post date:** [October 24, 2020, 8:18pm UTC](https://sleuthkit.discourse.group/t/find-host-name-of-user-machine/555/2 "2020-10-24T20:18:51Z")

</div>

Depends on the operating system.

---

<div class="post-metadata">

**Author:** ![it.dude](https://avatars.discourse-cdn.com/v4/letter/i/5daacb/32.png) [@it.dude](https://sleuthkit.discourse.group/u/it.dude)\
**Post date:** [July 20, 2021, 3:20am UTC](https://sleuthkit.discourse.group/t/find-host-name-of-user-machine/555/3 "2021-07-20T03:20:48Z")

</div>

On a Win Server 2016 .dd image, I found many .log files that had my PC hostname-longDate-AnotherNumber.log. Sleuthkit istat culled them. A .log search likely would produce a bunch, but with the hostname in front, you should be able to “discard the chaff from the wheat”