Evidence: DHCP Settings
Description: Collect DHCP (Dynamic Host Configuration Protocol) Settings
Category: Network
Platform: macos
Short Name: dhcpset
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
DHCP client leases record IP configuration and router details per interface. This data is essential for reconstructing network assignments and connectivity history.
Data Collected
This collector gathers structured data about dhcp settings.
Collection Method
This collector parses plist leases under /private/var/db/dhcpclient/leases and records them into dhcp_settings.
Forensic Value
This evidence is crucial for forensic investigations as it links devices to networks and IP addresses over time.
