6
2
A week ago my HP Mini 110 was stolen. I reported to the police and they asked me about my Laptop's MAC address, which I don't know or had never heard about before.
Is there any way to get the MAC address of my stolen laptop, as I have all the docs that prove my ownership of the laptop?
I've contacted HP to give me the MAC address, but they told me that it should be taken from the set itself and they can't help.
Ayman
Posted 2012-04-30T12:47:51.150
Reputation: 61
13
A MAC address looks something like this:
01:23:45:67:89:ab
It belongs to your network adapter and is used by the MAC sublayer to identify your computer on a network. It's not a unique identifier for various reasons (also explained in other answers here), but if you're lucky, you can trace back the laptop if it's ever found again.
If you can find it somewhere in your documentation that came with the laptop, then you're lucky. Apart from that, it'll be hard to find it elsewhere, although there are some possibilities.
If you've ever connected to a WiFi access point, you might be able to find your MAC address in its logs (or DHCP lease table) accessible through the access point's configuration website. This is because your laptop's MAC address is used as a unique identifier to tell the access point which IP address to assign. However, it's possible the access point already "forgot" your laptop, and it won't show it anymore.
In some cases, if your computer directly connected to a modem, its MAC address was used to identify it to your Internet Service Provider. In that case, you could check your modem configuration for the MAC address, or even your ISP registration forms.
I'd also suggest to look for the serial number of the laptop. It should definitely be available somewhere in the material that came with the machine. The serial number could also be on a warranty card, a sticker, et cetera.
However, note that MAC addresses can be changed – so there's no guarantee a knowledgeable thief hasn't already changed it, at least if the hardware allows that. The same goes for the serial number that's somewhere on a sticker (or even engraved) on your the machine. It's basically like stealing cars – even those could get new fake serial numbers if the thief is clever.
slhck
Posted 2012-04-30T12:47:51.150
Reputation: 182 472
Search for the MAC on the computer's box as well. – Giovanni Mascellani – 2014-10-06T06:55:17.050
Not sure, but is it possible a router the PC was connected to at their home would still contain the mac address ? – Moab – 2012-04-30T14:07:55.353
3@Moab: Probably. If the DHCP lease hasn't expired yet, and the router admin interface lets you list the DCHP client table. – Ariel – 2012-04-30T14:11:00.033
@Moab Yes, I'm still able to see some old DHCP leases from my Linksys router. But it of course depends on the configuration. – slhck – 2012-04-30T15:28:01.430
Might be their only shot at finding it. – Moab – 2012-04-30T15:30:33.067
They may use colons but sometimes I've seen MAC addresses use dashes instead (-). – Ben Richards – 2012-10-30T23:11:22.580
3
If you connected to your home internet, there is a log in the router that stores all mac adresses and the IP adresses. If you computer has been stolen and you need to give them the MAC adress of your laptop you can get it from there.
myname
Posted 2012-04-30T12:47:51.150
Reputation: 31
1
Maybe I'm over thinking this, but MAC spoofing is relatively easy, and the address isn't even unique. Honestly, the only way you're likely to get your laptop back is if the thief accidentally leaves it somewhere, and even then, the police would need to find it, and you would have to somehow prove to them that it's yours. I honestly think that the best course of action would be to change any internet passwords that are remembered by your stolen laptop's browser, buy a new computer, and move on. I can only hope that you have backups of any important data.
yutsi
Posted 2012-04-30T12:47:51.150
Reputation: 105
1
I know this question is old, but today I had a similiar headache myself after finding out that my router already "forgot" my recently stolen Macbook. There is one way not mentioned here, the storage backup. If you have access to any kind of backup from your stolen laptop, it is possible there are some wifi diagnostic files included. Not sure about windows, but from my OS X backup I dug up the whole wireless diagnostics archive (thank God I had this problem with wifi once hehe) and one of the files it contained was wireless_diagnostics-ilTACd.log, which inside among other technical stuff had the MAC address of my MacBook :)
SmOg3R
Posted 2012-04-30T12:47:51.150
Reputation: 11
0
If you can get the serial number for your laptop, the manufacturer may keep records of MAC address tied to system serial number. It's a bit of a long shot, but since MAC addresses are unique, this is definately possible for a company to track.
BloodyIron
Posted 2012-04-30T12:47:51.150
Reputation: 1 981
2MAC address are not unique, why does everyone think that, it simply is not true. – Ramhound – 2012-04-30T14:05:34.420
MAC addresses are not unique. – Will – 2012-04-30T14:12:40.657
2The first 3 hexidecimal pairs, ff:ff:ff are the manufacturer. The second 3 hexicdecimal pairs, ff:ff:ff are a serial set by the manufacturer themselves. Considering this, the potential permutations are 2.81474977 × 10^14, approximately 28,147,497,700,000 unique MAC addresses. That would be 4,115 MAC addresses per person according to current world population estimates. So explain to me how they aren't unique again, beyond the fact they can be spoofed? – BloodyIron – 2012-04-30T14:15:04.740
1Some manufacturers have been making NICs for over ten years, so there is no assurance that numbers haven't rolled over in that time and that's assuming that EVERY manufacturer NEVER reused even a single number. – Will – 2012-04-30T14:34:49.380
On top of that there are NICs out there that will allow the assigned MAC to be changed on the hardware rather than the OS level. – Will – 2012-04-30T14:36:31.467
1Considering how many permutations for the manufacturer's section of a MAC address there are, I'm sure more than one has filed for an additional manufacturer's designation. And yes, no manufacturer is perfect, but the IDEA is that a MAC address is a unique identifier, as per IEEE's design and specifications. Just because manufacturers don't always adhere to this does not negate the design. – BloodyIron – 2012-04-30T14:36:50.187
"In theory there is no two network cards with the same MAC address (on some network cards you can change its MAC address, especially on on-board models; also some low-end motherboard manufacturers have the bad habit of shipping motherboards using the same MAC address on more than one board, which can cause trouble on your network)."...http://www.hardwaresecrets.com/article/How-to-Discover-Your-Network-Card-Real-Manufacturer/414/2
– Moab – 2012-04-30T15:26:46.270@Moab this is where you seek police or legal representation. Their lack of willingness to cooperate is typically for reasonable security reasons, having professional representation or assistance in a legal facet changes the situation. – BloodyIron – 2012-04-30T15:33:04.927
1@BloodyIron - Saying something is unique and something being unique is two entirely different things. While the intention is that a device have a unique identification code, the MAC address itself, is not it. GUID for instance also is not guaranteed to be unique even though it stands for Global Unique Identifcation ( ID ). – Ramhound – 2012-04-30T15:35:36.730
1@moab and what if that laptop contains proprietary business information? Or something that is worth thousands of dollars? It's at the discretion of the police to pursue it or not. – BloodyIron – 2012-04-30T16:08:57.707
1@Ramhound: Well, technically social security numbers, driver license numbers, DNA, etc. aren't "unique" either. The first 2 have been known to be assigned to more than one people, and there's also no guarantee that mother nature (or a future geneticist) won't throw a curve ball at us and produce two people with identical DNA (with chimeras, they don't even need to look alike). But like GUID and MAC addresses, they are unique enough for most applications. – Lèse majesté – 2012-04-30T16:15:07.417
It's incredibly unlikely that 2 same-model laptops would have the same factory-assigned MAC address (it's trivial for the factory to ensure uniqueness, and there's no reason not to as having duplicate MAC addresses can cause problems). And if additional confirmation is needed, law enforcement can always check other hardware and software serial numbers. That said, except in very a set of very narrow circumstances, there's no practical way to actually locate a stolen laptop via MAC addresses. – Lèse majesté – 2012-04-30T16:17:04.577
@moab i'm just answering the question, your speculation has no place here. – BloodyIron – 2012-04-30T17:45:34.903
@BloodyIron you are the one speculating the laptop has "valuable data", and NO you are commenting on a question, now go away. – Moab – 2012-04-30T19:15:58.590
0
I don't mean to be a debby downer, but depending on the model of the network adapter, the MAC address can be changed. This may may make things a bit more difficult. They could have changed to something generic like DE:AD:BE:EF:20:12. On the other hand, this isn't something that is commonly known to be changeable because the stardard for years was that the address was "burned" in the chip by the manufacturer.
However, woliveirajr has a point in comment to your question in that if you have a router at home that you connect to, you stand a good chance of finding a log with all the different MAC addresses associated with their host name that has ever connected to it. Or if you you connect directly to the Web, your ISP may even be able to tell you the MAC address your modem has connected to it.
Chad Harrison
Posted 2012-04-30T12:47:51.150
Reputation: 5 759
Do you have any evidence that today's NICs don't have a burned in address? You can spoof your MAC address regardless of whether there's a burned in address or not, as MAC address spoofers only change what your system thinks/uses as your MAC address. They don't change the actual address stored in the EEPROM. So for the purpose of identifying a recovered laptop, MAC address spoofing is irrelevant. – Lèse majesté – 2012-05-03T04:50:59.397
I am sure that somewhere on every network adapter, there is a default MAC address burned in. But to wikipedia http://en.wikipedia.org/wiki/Mac_address
– Chad Harrison – 2012-05-03T13:16:49.143mentions there's also a "Firmware Mechanism" that stores the MAC which suggests that it's not just read-only memory. But aside from that, spoofing is very relevant as it's what other network devices see in regard to "tracking" it down. If the netbook ever connects publicly to an ISP, It would be easy to track down via the interwebs. – Chad Harrison – 2012-05-03T13:29:04.650
Right, for trying to use MAC addresses to track down a laptop, it is relevant, but that's unlikely to work anyway. I'm talking solely about using the burned in MAC address to identify a laptop that has been recovered by the police to prove it was a stolen laptop. In that case, it won't matter if the thief has used SMAC to change the MAC address they appear to have on the LAN. – Lèse majesté – 2012-05-03T17:02:47.583
0
I hope my answer is not given already. Usually the retail box also has the MAC and serial numbers as labels on it. Please notice, the Laptop may have several MACs, for WLAN and LAN. If you find the serial on the box, it might help more to identify the laptop.
Also check the retailers bill for serial / MAC.
@psusi MAC addresses can in fact serve as unique identifiers, but that isn't to say that there aren't duplicates. Vendors sometimes reuse old MAC addresses when they run out. – slantalpha – 2018-08-17T08:42:04.150
@jeff0000, my point was that the MAC address can not be used to locate the computer on the Internet since it is only known to the router the computer is connected to, and not the rest of the Internet. – psusi – 2018-08-21T12:55:46.680
@psusi If that's what you meant, I don't see it in your comment :) – slantalpha – 2018-08-21T15:46:36.033
3It could be written in some label in your manual, you know that the Mac address is made of 6 numbers in hexadecimal digits, right: Like a0:98:76:dc:32:10, perhaps without the ":". And have you used your laptop in your network? Isn't there some log in the network of the times you connected your laptop ? – woliveirajr – 2012-04-30T12:52:56.963
2You can't "trace" a laptop with its MAC address. – psusi – 2012-04-30T13:18:28.930
3@psusi you can "trace" it in the sense that if he can show that he owned a laptop with a particular MAC address, and a laptop is found with one that matches it, it can be identified as being his. From dictionary.com: 'trace, verb: to follow evidence; to ascertain by investigation" – xdumaine – 2012-04-30T14:01:39.063
Ayman, check the edit to slhck's answer, MAC address it might be found in your router or other router you connected to with that laptop before it was stolen. – Moab – 2012-04-30T15:32:44.877
@Moab That wasn't in an edit, it was there all along, even in the original answer ;) – slhck – 2012-04-30T20:12:04.823
oh, I saw the edited xxx hours ago, made an assumption, my bad – Moab – 2012-04-30T20:48:38.880