6

A week ago my HP Mini 110 was stolen. I reported to the police and they asked me about my Laptop's MAC address, which I don't know or had never heard about before.

Is there any way to get the MAC address of my stolen laptop, as I have all the docs that prove my ownership of the laptop?

I've contacted HP to give me the MAC address, but they told me that it should be taken from the set itself and they can't help.

slhck
  • 223,558
  • 70
  • 607
  • 592
Ayman
  • 61
  • 1
  • 1
  • 2
  • 3
    It could be written in some label in your manual, you know that the Mac address is made of 6 numbers in hexadecimal digits, right: Like a0:98:76:dc:32:10, perhaps without the ":". And have you used your laptop in your network? Isn't there some log in the network of the times you connected your laptop ? – woliveirajr Apr 30 '12 at 12:52
  • 2
    You can't "trace" a laptop with its MAC address. – psusi Apr 30 '12 at 13:18
  • 3
    @psusi you can "trace" it in the sense that if he can show that he owned a laptop with a particular MAC address, and a laptop is found with one that matches it, it can be identified as being his. From dictionary.com: 'trace, verb: to follow evidence; to ascertain by investigation" – xdumaine Apr 30 '12 at 14:01
  • Ayman, check the edit to slhck's answer, MAC address it might be found in your router or other router you connected to with that laptop before it was stolen. – Moab Apr 30 '12 at 15:32
  • @Moab That wasn't in an edit, it was there all along, even in the original answer ;) – slhck Apr 30 '12 at 20:12
  • oh, I saw the edited xxx hours ago, made an assumption, my bad – Moab Apr 30 '12 at 20:48
  • @psusi MAC addresses can in fact serve as unique identifiers, but that isn't to say that there aren't duplicates. Vendors sometimes reuse old MAC addresses when they run out. – slantalpha Aug 17 '18 at 08:42
  • @jeff0000, my point was that the MAC address can not be used to locate the computer on the Internet since it is only known to the router the computer is connected to, and not the rest of the Internet. – psusi Aug 21 '18 at 12:55
  • @psusi If that's what you meant, I don't see it in your comment :) – slantalpha Aug 21 '18 at 15:46

7 Answers7

13

A MAC address looks something like this:

01:23:45:67:89:ab

It belongs to your network adapter and is used by the MAC sublayer to identify your computer on a network. It's not a unique identifier for various reasons (also explained in other answers here), but if you're lucky, you can trace back the laptop if it's ever found again.

Looking in your documentation …

If you can find it somewhere in your documentation that came with the laptop, then you're lucky. Apart from that, it'll be hard to find it elsewhere, although there are some possibilities.

WiFi access points you've connected to

If you've ever connected to a WiFi access point, you might be able to find your MAC address in its logs (or DHCP lease table) accessible through the access point's configuration website. This is because your laptop's MAC address is used as a unique identifier to tell the access point which IP address to assign. However, it's possible the access point already "forgot" your laptop, and it won't show it anymore.

A directly connected modem

In some cases, if your computer directly connected to a modem, its MAC address was used to identify it to your Internet Service Provider. In that case, you could check your modem configuration for the MAC address, or even your ISP registration forms.

I'd also suggest to look for the serial number of the laptop. It should definitely be available somewhere in the material that came with the machine. The serial number could also be on a warranty card, a sticker, et cetera.

However, note that MAC addresses can be changed – so there's no guarantee a knowledgeable thief hasn't already changed it, at least if the hardware allows that. The same goes for the serial number that's somewhere on a sticker (or even engraved) on your the machine. It's basically like stealing cars – even those could get new fake serial numbers if the thief is clever.

slhck
  • 223,558
  • 70
  • 607
  • 592
4

If you connected to your home internet, there is a log in the router that stores all mac adresses and the IP adresses. If you computer has been stolen and you need to give them the MAC adress of your laptop you can get it from there.

myname
  • 41
  • 1
1

Maybe I'm over thinking this, but MAC spoofing is relatively easy, and the address isn't even unique. Honestly, the only way you're likely to get your laptop back is if the thief accidentally leaves it somewhere, and even then, the police would need to find it, and you would have to somehow prove to them that it's yours. I honestly think that the best course of action would be to change any internet passwords that are remembered by your stolen laptop's browser, buy a new computer, and move on. I can only hope that you have backups of any important data.

yutsi
  • 103
  • 1
  • 9
1

I know this question is old, but today I had a similiar headache myself after finding out that my router already "forgot" my recently stolen Macbook. There is one way not mentioned here, the storage backup. If you have access to any kind of backup from your stolen laptop, it is possible there are some wifi diagnostic files included. Not sure about windows, but from my OS X backup I dug up the whole wireless diagnostics archive (thank God I had this problem with wifi once hehe) and one of the files it contained was wireless_diagnostics-ilTACd.log, which inside among other technical stuff had the MAC address of my MacBook :)

SmOg3R
  • 11
  • 1
0

If you can get the serial number for your laptop, the manufacturer may keep records of MAC address tied to system serial number. It's a bit of a long shot, but since MAC addresses are unique, this is definately possible for a company to track.

BloodyIron
  • 2,041
  • 16
  • 21
  • 2
    MAC address are not unique, why does everyone think that, it simply is not true. – Ramhound Apr 30 '12 at 14:05
  • MAC addresses are not unique. – Will Apr 30 '12 at 14:12
  • 2
    The first 3 hexidecimal pairs, ff:ff:ff are the manufacturer. The second 3 hexicdecimal pairs, ff:ff:ff are a serial set by the manufacturer themselves. Considering this, the potential permutations are 2.81474977 × 10^14, approximately 28,147,497,700,000 unique MAC addresses. That would be 4,115 MAC addresses per person according to current world population estimates. So explain to me how they aren't unique again, beyond the fact they can be spoofed? – BloodyIron Apr 30 '12 at 14:15
  • 1
    Some manufacturers have been making NICs for over ten years, so there is no assurance that numbers haven't rolled over in that time and that's assuming that EVERY manufacturer NEVER reused even a single number. – Will Apr 30 '12 at 14:34
  • On top of that there are NICs out there that will allow the assigned MAC to be changed on the hardware rather than the OS level. – Will Apr 30 '12 at 14:36
  • 1
    Considering how many permutations for the manufacturer's section of a MAC address there are, I'm sure more than one has filed for an additional manufacturer's designation. And yes, no manufacturer is perfect, but the IDEA is that a MAC address is a unique identifier, as per IEEE's design and specifications. Just because manufacturers don't always adhere to this does not negate the design. – BloodyIron Apr 30 '12 at 14:36
  • "In theory there is no two network cards with the same MAC address (on some network cards you can change its MAC address, especially on on-board models; also some low-end motherboard manufacturers have the bad habit of shipping motherboards using the same MAC address on more than one board, which can cause trouble on your network)."...http://www.hardwaresecrets.com/article/How-to-Discover-Your-Network-Card-Real-Manufacturer/414/2 – Moab Apr 30 '12 at 15:26
  • @Moab this is where you seek police or legal representation. Their lack of willingness to cooperate is typically for reasonable security reasons, having professional representation or assistance in a legal facet changes the situation. – BloodyIron Apr 30 '12 at 15:33
  • 1
    @BloodyIron - Saying something is unique and something being unique is two entirely different things. While the intention is that a device have a unique identification code, the MAC address itself, is not it. GUID for instance also is not guaranteed to be unique even though it stands for Global Unique Identifcation ( ID ). – Ramhound Apr 30 '12 at 15:35
  • 1
    @moab and what if that laptop contains proprietary business information? Or something that is worth thousands of dollars? It's at the discretion of the police to pursue it or not. – BloodyIron Apr 30 '12 at 16:08
  • 1
    @Ramhound: Well, technically social security numbers, driver license numbers, DNA, etc. aren't "unique" either. The first 2 have been known to be assigned to more than one people, and there's also no guarantee that mother nature (or a future geneticist) won't throw a curve ball at us and produce two people with identical DNA (with chimeras, they don't even need to look alike). But like GUID and MAC addresses, they are unique enough for most applications. – Lèse majesté Apr 30 '12 at 16:15
  • It's incredibly unlikely that 2 same-model laptops would have the same factory-assigned MAC address (it's trivial for the factory to ensure uniqueness, and there's no reason not to as having duplicate MAC addresses can cause problems). And if additional confirmation is needed, law enforcement can always check other hardware and software serial numbers. That said, except in very a set of very narrow circumstances, there's no practical way to actually locate a stolen laptop via MAC addresses. – Lèse majesté Apr 30 '12 at 16:17
  • @moab i'm just answering the question, your speculation has no place here. – BloodyIron Apr 30 '12 at 17:45
  • @BloodyIron you are the one speculating the laptop has "valuable data", and NO you are commenting on a question, now go away. – Moab Apr 30 '12 at 19:15
0

I don't mean to be a debby downer, but depending on the model of the network adapter, the MAC address can be changed. This may may make things a bit more difficult. They could have changed to something generic like DE:AD:BE:EF:20:12. On the other hand, this isn't something that is commonly known to be changeable because the stardard for years was that the address was "burned" in the chip by the manufacturer.

However, woliveirajr has a point in comment to your question in that if you have a router at home that you connect to, you stand a good chance of finding a log with all the different MAC addresses associated with their host name that has ever connected to it. Or if you you connect directly to the Web, your ISP may even be able to tell you the MAC address your modem has connected to it.

Chad Harrison
  • 6,069
  • 13
  • 44
  • 60
  • Do you have any evidence that today's NICs don't have a burned in address? You can spoof your MAC address regardless of whether there's a burned in address or not, as MAC address spoofers only change what your system thinks/uses as your MAC address. They don't change the actual address stored in the EEPROM. So for the purpose of identifying a recovered laptop, MAC address spoofing is irrelevant. – Lèse majesté May 03 '12 at 04:50
  • I am sure that somewhere on every network adapter, there is a default MAC address burned in. But to wikipedia http://en.wikipedia.org/wiki/Mac_address – Chad Harrison May 03 '12 at 13:16
  • mentions there's also a "Firmware Mechanism" that stores the MAC which suggests that it's not just read-only memory. But aside from that, spoofing is very relevant as it's what other network devices see in regard to "tracking" it down. If the netbook ever connects publicly to an ISP, It would be easy to track down via the interwebs. – Chad Harrison May 03 '12 at 13:29
  • Right, for trying to use MAC addresses to track down a laptop, it _is_ relevant, but that's unlikely to work anyway. I'm talking solely about using the burned in MAC address to identify a laptop that has been recovered by the police to prove it was a stolen laptop. In that case, it won't matter if the thief has used SMAC to change the MAC address they appear to have on the LAN. – Lèse majesté May 03 '12 at 17:02
0

I hope my answer is not given already. Usually the retail box also has the MAC and serial numbers as labels on it. Please notice, the Laptop may have several MACs, for WLAN and LAN. If you find the serial on the box, it might help more to identify the laptop.

Also check the retailers bill for serial / MAC.