NetworkList Forensics Cheat Sheet

What it is

Windows' Network Location Awareness service identifies each network the machine connects to and stores a profile for it in the SOFTWARE hive: name (SSID for Wi-Fi, domain or "Network" for wired), category (public, private, domain), gateway MAC address and connection dates. WLAN profiles are also stored as XML files. Together they place a laptop on a given network at a given time: home, hotel, café, a competitor's guest Wi-Fi, a mobile hotspot.

Location

Artifact	Location
Profiles	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{profile GUID}`
Signatures (link to gateway, DNS suffix)	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed\<id>` and `\Unmanaged\<id>`
Intranet cache	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet`
WLAN profiles	`C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{interface GUID}\{profile GUID}.xml`
WLAN events	`Microsoft-Windows-WLAN-AutoConfig/Operational` (for example 8001 connected, 8003 disconnected)

Present on Windows Vista and later.

What it proves

The host connected to a network with this name, and the first and last time it did.
Wi-Fi networks are identified by SSID; DefaultGatewayMac identifies the physical router, which can be geolocated through Wi-Fi databases or matched to a known site.
The profile GUID is the L2ProfileId referenced by SRUM, which gives bytes sent and received per app on that network.
It does not record every connection; use WLAN events and SRUM for the details in between.

Key fields

Value	Where	Meaning
`ProfileName`, `Description`	Profiles	Network name (SSID or domain)
`Category`	Profiles	0 public, 1 private, 2 domain
`NameType`	Profiles	Type of network (for example 0x47 wireless, 0x06 wired, 0x17 mobile broadband)
`DateCreated`	Profiles	First connection
`DateLastConnected`	Profiles	Last connection
`ProfileGuid`	Signatures	Links back to the profile
`DefaultGatewayMac`	Signatures	MAC address of the gateway
`DnsSuffix`, `FirstNetwork`	Signatures	DNS suffix, SSID

Timestamps

Timestamp	Set when	Format	Pitfalls
`DateCreated`	First connection to the network	16-byte SYSTEMTIME, local time	Convert with the time zone in effect at that date (UTC vs local time)
`DateLastConnected`	Most recent connection	SYSTEMTIME, local time	Travellers change time zones; check `TimeZoneInformation` and context
Profile key LastWrite	Profile updated	FILETIME, UTC	Often close to the last connection
WLAN event `SystemTime`	Connect / disconnect	UTC	Log may roll over

Retention and clearing

Profiles persist until the user "forgets" the network or an administrator deletes them; forgetting a Wi-Fi network removes the WLAN XML profile but registry traces can remain.
Deleted profile keys can be recovered from hive slack and shadow-copy SOFTWARE hives.

Collection

KAPE targets: RegistryHivesSystem (SOFTWARE hive) and EventLogs (WLAN-AutoConfig). No standard target collects the Wlansvc\Profiles XML files: copy them explicitly.
Velociraptor (Windows.Triage.Targets): RegistryHivesSystem, EventLogs; collect ProgramData\Microsoft\Wlansvc\Profiles separately, for example with Windows.Search.FileFinder.
Built-in:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /s
netsh wlan show profiles
wevtutil qe Microsoft-Windows-WLAN-AutoConfig/Operational /q:"*[System[(EventID=8001)]]" /f:text /c:20

Parsing tools

Registry Explorer / RECmd (Eric Zimmerman): decodes SYSTEMTIME values and joins profiles to signatures.
RegRipper: networklist plugin.
WifiHistoryView (NirSoft): Wi-Fi connection history from the WLAN event log.

Investigation tips

Map L2ProfileId in SRUM to ProfileName to show that a large upload happened while the laptop was on a personal hotspot, not the corporate network.
Hotel, airport and coffee-shop SSIDs help confirm travel and the time zone to apply to local-time artifacts.
A new profile created shortly before an incident (a phone hotspot, an unknown SSID) can explain how data left without crossing the corporate proxy.
Use DefaultGatewayMac to distinguish two networks with the same generic SSID.

Network profiles (NetworkList)

Tools