Police found & returned my stolen laptop reformatted by thief. Can installation logs help locate the thief?

Solution 1:

When Windows receives an IP via DHCP, as far as I know, it is not recorded anywhere. It has a somewhat low chance of helping you as most residental connections are behind NAT, in such case all you would find is a private IP address.

If the thief joined a wireless network, perhaps it is still in the Network and Sharing center.

The Windows installation process does not go online except when applying Windows updates. The "Network Location Awareness" feature of Windows causes the system to make a DNS query and HTTP connection to msftncsi.com each time the adapter is brought up or down, but the results of this aren't recorded.

If the laptop has all Windows updates, or was ever connected to the Internet, then Microsoft likely has the IP address logged somewhere, but they are unlikely to just hand the information over to you without being compelled by a law enforcement authority.

You may look in the system's Event viewer just in case, but I don't think you will find anything