1

I'm working on making an incident response disk and I wanted to be able to run a copy of ipconfig off of external media such as a usb drive. This seems to work on my windows xp machine but when I copy ipconfig outside of system32 directory, it will not run.

I also noticed this issue with netstat and several other networking utilities.

What can I do to run a windows 7 version of ipconfig on an external drive?

blindude24
  • 11
  • 1
  • 2
  • Isn't ipconfig part of every windows install, so you wouldn't need to have it running on a USB stick? – Dennis G Jun 13 '11 at 22:41
  • It is part of every install but the idea is that I could be getting this information off of a system that is infected with malware, so the application and it's dll files could be compromised on the system so I want to use a trusted source on my usb drive. – blindude24 Jun 14 '11 at 14:14
  • you're better of running third party tools for your usb stick. `ipconfig.exe` for examples requires `sechost.dll`, `dnsapi.dll`, `winnsi.dll`, etc. they could all be infected. (try Nirsoft for some very handy tools) – Dennis G Jun 14 '11 at 14:27
  • Good tip moontear, but I am curious as to what ipconfig needs to run that makes it not work outside of the system32 folder. I have even tried copying the entire system32 folder and running ipconfig within there and having it not work. I'm wondering what it is tied to now in windows 7 which prevents this from working. – blindude24 Jun 14 '11 at 14:49

1 Answers1

3

Several Windows networking utilities need a .MUI supporting file from the US-EN sub-folder in order to run. For example, c:\windows\system32\ipconfig.exe requires c:\windows\system32\en-US\ipconfig.exe.mui to run.

An easy way to copy the executable you want and its supporting file is to use the copy command using the /s (include sub-folders) option:

xcopy /s c:\windows\system32\netstat* d:\irtookit
xcopy /s c:\windows\system32\ipconfig* d:\irtookit
xcopy /s c:\windows\system32\whoami* d:\irtookit

For example, this will copy both ipconfig and \US-EN\ipconfig.exe.mui to d:\irtoolkit.

Now, if you run d:\irtoolkit\ipconfig it will work.

jonsca
  • 10,218
  • 26
  • 54
  • 62
tonyvance
  • 31
  • 2