19

I have a dead Windows install in one of my partitions. It doesn't have any boot data anymore. Practically, it is only a filesystem dump. But I have access to read any files on its filesystem.

How could I identify which Windows version is it? In the ideal case, I think there should be some configuration setting or any file unique to the different Windows versions. For example, on Debian-based Linux distros, I could simply read /etc/debian_version.

Unfortunately, I have access only to a Linux box to reach its hard disk. So, solutions requiring a Windows (for example, digging in the version of ntoskrnl.exe, or checking some registry settings) aren't in my case, feasible.

peterh
  • 2,782

2 Answers2

12

Simple. Look at the version of <drive>:\Windows\System32\ntoskrnl.exe

In the case of XP, look for <drive>:\boot.ini

If it is Vista+ you can look for the <drive>:\Boot folder.

For Windows 7+ you can look in device manager for the hidden System Reserved partition.

If there is a file named license.rtf in your C:\Windows\System32 folder, it also contains your current Windows version.

peterh
  • 2,782
td512
  • 5,170
0

You could also stream

strings cmd.exe | find "Version" might work too. Most files have the version of windows in their property sheet, which is visible in the raw binary near the end of it. One of these is the windows version. It's in unicode though.

wendy.krieger
  • 718