Sign in with
Sign up | Sign in
Your question
Solved

Finding The IP Address Of The Computer Which Created A File

Last response: in Windows XP
Share
March 24, 2011 4:04:38 PM

Hello, I was wondering if it was possible to find the internal IP address of the computer which created a file. I would be finding this on xp pro.
Thanks In Advance
a b 8 Security
March 24, 2011 4:09:17 PM

That information is not stored anywhere in the file, you may be able to get the user name of the person that created it by checking the properties of the file. I'm not a PC forensics expert, but have looked at many file properties, none of them state which PC they were created on.

You can also check the Security tab and see if there is a PC or username in there that will lead you somewhere.
m
0
l
a b 8 Security
March 24, 2011 4:41:16 PM

In general there is no way to tell who created a file or on which computer it was created. If this sort of information is important you need to turn on user account auditing and audit the creation of objects.

Some programs, such as Word, may contain the name of the creator but not the computer it was created on. The IP address doesn't come into it - a computer doesn't need an IP address, or any form of networking, to create a file.
m
0
l
Related resources
March 24, 2011 5:34:52 PM

This file is stored on a network server, however. I was wondering if windows has any way of marking the file as to which computer it was saved from on the network.
m
0
l
a b 8 Security
March 24, 2011 5:40:50 PM

Lagomorph said:
This file is stored on a network server, however. I was wondering if windows has any way of marking the file as to which computer it was saved from on the network.


No, it just saves the general info in the file, user that created it (if setup in Office), file type, date of creation, etc..

If you have auditing turned on in the server, you may be able to see which user placed the file there, and possibly which PC it came from. Just the file itself though won't tell you what computer it came from.
m
0
l
March 24, 2011 5:53:14 PM

I just confirmed that auditing is turned on for the server. How would I go about finding the user and computer from there?
m
0
l

Best solution

a b 8 Security
March 24, 2011 5:57:43 PM

Check with the system admins, they'd need to go over the logs. This should help: http://www.experts-exchange.com/OS/Microsoft_Operating_...
Share
March 24, 2011 6:09:26 PM

Best answer selected by Lagomorph.
m
0
l
!