42

I am attempting to recover an old computer that won't boot and I'm not sure what version of Windows it is running. How do I tell simply by examining the file system?

I am fairly confident it is either Vista or Windows 7. There is a small chance it is Windows Server 2008.

Improve this question
3

12 Answers 12

Reset to default
15

Your best bet is going to be finding the properties of a Windows Executable (such as explorer.exe). In my case it's File and Product version is 6.1.7601.17567

6.0.xxxx.xxxxx will denote Windows Vista (with 6000, 6001 and 6002 being RTM, SP1 and SP2 respectively).

6.1.xxxx.xxxxx will denote Windows 7 (with 7600 and 7601 being RTM and SP1).

The same version numbers will apply for Windows server as well so I'm not sure how you'd tell the difference with those using this method.

Improve this answer
1
  • This method offers a decent heuristic, but not all files are updated with each system update. For example, my Windows version is 19045.3570 as per the winver.exe command, but when I do dir *.exe | %{$_.VersionInfo} in my C:\Windows\system32 folder, my results include 7.0.19041.3570 7.0.19041.357... C:\Windows\system32\SearchProtocolHost.exe 10.0.19041.1 10.0.19041.1 ... C:\Windows\system32\SecEdit.exe 10.0.19041.1 10.0.19041.1 ... C:\Windows\system32\secinit.exe 10.0.19041.3570 10.0.19041.35... C:\Windows\system32\SecureBootEncodeUEFI.exe
    – dhalsim2
    Oct 28, 2023 at 1:26
40

Look at the file

C:\Windows\System32\License.rtf

Can be found for all these Windows operating systems

Vista, W7, W8, W8.1

These License rtf will have the Version of Windows and the Edition also, Windows 7 Pro for example.

Windows 10 has the rtf file but does not show edition, but if it has the arbitration clause note at the top you know it is W10, or use the explorer trick in Matthew Steeples answer.

To find the Windows 10 product type (Home Pro etc) type see Moif Murphy's answer further down this page

Improve this answer
7
  • 8
    This is especially nice for Linux users.
    – code_onkel
    Jul 20, 2016 at 13:03
  • In Linux, you'll probably have to mount your Windows partition. You can use the blkid command, and look for TYPE="ntfs". In my case, its /dev/sda2. Then: sudo mount -t ntfs /dev/sda2 <your mount point>. You can look at the rtf file with libreoffice.
    – AAAfarmclub
    Oct 4, 2018 at 0:30
  • On my dual boot system (Bunsen Helium and WINDOWS 7 HOME PREMIUM), it was lower case: license.rtf
    – AAAfarmclub
    Oct 4, 2018 at 0:35
  • Same here on a windows 7 ultimate. Very important note because Linux is case-sensitive and often sorts that way as well.
    – Arlen Beiler
    Nov 19, 2018 at 4:57
  • 2
    On Windows 10 you can check the folder: C:\Windows\System32\Licenses. It should contain something like c:\Windows\System32\Licenses\neutral\_Default\Professional\license.rtf for Pro edition. For Windows 10 Enterprise it seem to have both Enterprise and Professional folders. I'm guessing Home editions will have Home folder.
    – Nux
    Jul 27, 2019 at 23:05
18

For Windows 10 one can use Wordpad.exe, notepad.exe on Windows OS for analyzing
C:\ProgramData\Microsoft\Diagnosis\osver.txt .

On Unix systems a console command like
cat <Windows system root partition>/ProgramData/Microsoft/Diagnosis/osver.txt
shows version number.

Example for OS build number: 10.0.18362 (without .116 - .267@2019-07-26)

Improve this answer
3
  • recognized lately, that even 'cat' command works on Windows 10 powershell ('help' might also show 'type' or 'gc')
    – beyondtime
    Aug 8, 2020 at 6:52
  • 2
    I like the simplicity of the answer and how it compares to Linux' /etc/os-release.
    – LiveWireBT
    Oct 8, 2022 at 8:59
  • @LiveWireBT your Edit on this question is controversial. You might want to write an answer on your own instead of adding this huge section about windows 11. I approved it anyways, as it clearly improved the answer and added updated information.
    – mashuptwice
    Oct 9, 2022 at 3:42
13

If you don't have a running Windows and want to find the information from a Linux machine, you can use hivexget to read the registry file on the disk.

For Debian-based systems, install it with sudo apt install libhivex-bin.

Example (with grep to make the output shorter):

# hivexget /mnt/tmp/Windows/System32/config/software 'Microsoft\Windows NT\CurrentVersion' \
| egrep 'BuildLab|ProductName|Version"|"ProductId'


"BuildLab"="19041.vb_release.191206-1406"
"BuildLabEx"="19041.1.amd64fre.vb_release.191206-1406"
"CurrentVersion"="6.3"
"EditionSubVersion"=""
"ProductName"="Windows 10 Pro"
"ProductId"="00330-80000-00000-AA669"
"DisplayVersion"="21H1"

You may have to adapt the case of the path and file name. For example the registry file could be "SOFTWARE" instead of "software", etc.

Remove the | egrep ... part to see all values under that key.

Improve this answer
1
11

Using the registry you can look up version and edition

I found this answer over at Stackoverflow to the question Determine Windows Version, Edition and Service Pack OF AN OFFLINE DISK IMAGE

Use the values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. I presume you know where to find that hive?! The respective hive can be found under %SystemRoot%\System32\config with the name SOFTWARE.

Side-note: you can attempt to verify your results by looking at some well-known files (e.g. kernel32.dll, ntdll.dll) and into their version information resource (what you're looking for is the file version: with, e.g. GetFileVersionInfo()).

Edition values, if that's needed, can be found at HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions.

More specifically, how to load the hive of another registry:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/regedit_load_hive.mspx?mfr=true

Improve this answer
4
  • 1
    -1 OP mentioned it won't boot making viewing the registry quite tricky...
    – HaydnWVN
    Nov 30, 2011 at 16:54
  • 7
    You can load a different hive into regedit, I'm fairly sure. If not, I bet there's a tool that can do it.
    – Rob
    Nov 30, 2011 at 16:56
  • 1
    Yes, loading hives is possible with regedit from any Windows. The system seems unaffected by this if you are careful (choose a temporary name when loading and then unload the hive). See more: zeda.nl/index.php/en/load-user-registry-hive-in-regedit
    – Nux
    Jul 27, 2019 at 23:08
  • If gpedit.msc is missing in system 32 folder it is home. superuser.com/questions/1325305/…
    – Alex78191
    Nov 29, 2023 at 12:09
7

If you have Linux on the same system, you could boot into Linux, ensure the Windows partition is mounted (for instance here it's in /mnt/C) and then do strings /mnt/C/Windows/System32/ntoskrnl.exe 2>/dev/null | grep amd64. For me in printed 9600.18258.amd64fre.winblue_ltsb.160303-0600, and googling for winblue indicates that this was the code name for Windows 8.1.

Improve this answer
2
  • +1 This the best way I've found to get the Windows 10 version. The string has the build number at the start - in my case 14393 (14393.351.amd64fre.rs1_release_inmarket.161014-1755). Looking at the Windows 10 release info, that corresponds to version 1607.
    – wjandrea
    Mar 3, 2018 at 3:31
  • Just a couple years later, I can't find any sort of text like this in ntoskrnl, ntdll, explorer, kernel32, etc. Badly damaged Win10 partition. mivk's answer worked however. Win10 Home.
    – rdtsc
    Jul 16, 2020 at 2:32
3

If you boot into Windows installation media (say USB stick), and press [SHIFT] + [F10] to get the command prompt, you could query which drive letter corresponds to the original OS drive in question, and then get the version info of a program like ntoskrnl.exe. For example to explore the installed disks and related drive letters,

$ wmic diskdrive get model,name,serialnumber
$ wmic logicaldisk get description,deviceid,volumename
$ wmic datafile where name="<DRIVE LETTER>:\\Windows\\System32\\ntoskrnl.exe" get Version /value

Version 10.0.15063.413

Or using the method from @beyondtime, which is less typing but omits the decimal part of the build number

$ type "<DRIVE LETTER>:\ProgramData\Microsoft\Diagnosis\osver.txt"

10.0.15063

So here the OS installed on the indicated drive letter is Windows 10, Build 15063.413. A google search shows this to be Windows 10 version 1703 | Redstone 2 | Creators Update.

As a bonus, if you want to see the last time that OS was booted, you can do

$ dir /ah /tw <DRIVE LETTER>:\pagefile.sys

01/31/2017  03:04 PM   ......  pagefile.sys

You can probably determine when the OS was originally installed by reviewing the creation time of the hidden files and folders at the root of the drive:

$ dir /ah /tc "<DRIVE LETTER>:\"

And to shutdown when you're finished:

$ wpeutil shutdown
Improve this answer
2

If you can still run executables from that filesystem, you can run C:\Windows\System32\winver.exe

Improve this answer
3
  • 5
    Wouldn't that just give you the version that you run winver.exe on?
    – Rob
    Nov 30, 2011 at 16:56
  • I ran it and it gave me the correct version of Windows (home premium, starter, etc.), which build, which service pack, and whom the version of windows was licensed to.
    – Yzmir Ramirez
    Jul 1, 2012 at 15:00
  • I tried this. It only gave me the version of Windows that I am currently running, not what is installed on the inactive hard drive.
    – dhalsim2
    Oct 27, 2023 at 23:40
1

From mivk's answer, with some bashisms

And after reading hivexsh man page...

Preamble

In order to find correct filename, I do:

rfile=($mnt/[wW][iI][nN][dD][oO][wW][sS]/[sS][yY][sS][tT][eE][mM]32)
rfile=(${rfile[@]/%//[cC][oO][nN][fF][iI][gG]})
rfile=(${rfile[@]/%//[sS][oO][fF][tT][wW][aA][rR][eE]})

Then

hivexsh "$rfile" < <(
    echo 'cd Microsoft\Windows NT\CurrentVersion'
    for key in ProductName CurrentVersion ProductId BuildLab ;do
        echo lsval $key
    done
)

Will output in order I asked for:

Windows 10 Pro
6.3
00330-80000-00000-AA497
22000.co_release.210604-1628

or

Microsoft Windows XP
5.1
55711-OEM-0011903-00117
2600.xpsp_sp3_qfe.130704-0421
Improve this answer
0

Get Magical Jelly Bean Keyfinder. The portable free version works fine. Safest to get it from their website magicaljellybean.com or sofpedia etc.

Start it up. Under the tools menu, select >> load hive. It then shows all your drives, select the windows folder of the drive in question. It instantly provides the version and keys.

Improve this answer
3
  • 1
    Magical Jelly Bean Keyfinder is known to report the incorrect license key. It also is nagware, that only works correctly, if you purchase it. It also isn't required to determine which instalation of Windows is on a filesystem, much easier ways, then using that nagware like Magical Jelly Bean Keyfinder which did I mention doesn't even work?
    – Ramhound
    Oct 31, 2016 at 20:52
  • 1
    I've used it for years, never any nags or ads. You must have got a hijacked version. The issue here is not about keys, but getting the exact version of Windows, which keyfinder reports accurately.. It requires 0 expertise, 0 hunting for ini files or hive entries and gives you a complete answer in seconds effortlessly without trying to figure out product code or match version data.. If you had a better/easier solution why not describe it.
    – fred64
    Oct 31, 2016 at 21:25
  • Nope; Got it straight from the publisher whom signed the executable
    – Ramhound
    Oct 31, 2016 at 22:07
0

Comprehensive information about Windows version is contained in the registry under HKLM\Software\Microsoft\Windows NT\CurrentVersion. You will need to load a corresponding hive from the system in question:

reg load HKLM\Temp x:\Windows\System32\config\SOFTWARE

where Temp is arbitrary name you will use and x:\Windows is path to that system root.

Then you will be able to query the details:

reg query "HKLM\Temp\Microsoft\Windows NT\CurrentVersion" /v *

You might be specifically interested in CurrentBuildNumber, UBR (Update Build Revision), CurrentVersion, EditionID, ProductName, DisplayVersion, e.g.

reg query "HKLM\Temp\Microsoft\Windows NT\CurrentVersion" /v ProductName
Improve this answer
-1

Open the file bootmgr in notepad it is located on the hard drive you are wanting to know the version of it will be a hidden file so select show hidden files in folder options sorted

Improve this answer
1
  • 1
    This is a 300 KB+ binary file and I did not find anything about windows version in this.
    – Jerther
    Aug 10, 2017 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .