# How to get the hostname from a .E01 image

**URL:** <https://sleuthkit.discourse.group/t/how-to-get-the-hostname-from-a-e01-image/297>\
**Category:** Autopsy Help\
**Created:** [October 2, 2019, 12:19pm UTC](https://sleuthkit.discourse.group/t/how-to-get-the-hostname-from-a-e01-image/297 "2019-10-02T12:19:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JJ\_Um](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/jj_um/32/142_2.png) [@JJ\_Um](https://sleuthkit.discourse.group/u/JJ_Um)\
**Post date:** [October 2, 2019, 12:19pm UTC](https://sleuthkit.discourse.group/t/how-to-get-the-hostname-from-a-e01-image/297/1 "2019-10-02T12:19:46Z")

</div>

Hi.

I am trying to find the hostname of the user’s computer from this image file but I do not know where to look to find it. I know where it is in the registry but obviously cannot search that through Autopsy.

Does anyone know where/what file I need to look into to find the hostname of the machine?

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [October 2, 2019, 12:32pm UTC](https://sleuthkit.discourse.group/t/how-to-get-the-hostname-from-a-e01-image/297/2 "2019-10-02T12:32:21Z")

</div>

Try running the Recent Activity ingest module and see if you get any results under Results-\>Extracted Content-\>Operating System Information. I believe the hostname is under the “name” field.

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [October 2, 2019, 1:58pm UTC](https://sleuthkit.discourse.group/t/how-to-get-the-hostname-from-a-e01-image/297/3 "2019-10-02T13:58:38Z")

</div>

If you are using version 4.12 there is also a registry viewer available so if you know the location of the host name you can go right to it in the registry.