Having the last known IP address of a machine can help you to identify if it was in the wrong segment of the network (everyone does segment their network…. right?), if the address was static or dynamically assigned or if it had been connected directly to the internet.

Within the System Hive there lives a key, the address of that key is thus:

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

Regviewer will give you this nice view, highlighted is the last DHCP address this machine had. As you can see from a lot of the other fields this is a one-stop shop for basic interface information.

The name of the Key (starting C1CC) is the GUID of the NIC, my next post will show why this is relevant…. get a pen and write it down! I actually don’t know what this VM was connected to, those details are not from any of my networks, so lets go find out shall we?