Hi.
I am trying to find the hostname of the user’s computer from this image file but I do not know where to look to find it. I know where it is in the registry but obviously cannot search that through Autopsy.
Does anyone know where/what file I need to look into to find the hostname of the machine?
Try running the Recent Activity ingest module and see if you get any results under Results->Extracted Content->Operating System Information. I believe the hostname is under the “name” field.
If you are using version 4.12 there is also a registry viewer available so if you know the location of the host name you can go right to it in the registry.