24

I am attempting to recover an old computer that won't boot and I'm not sure what version of Windows it is running. How do I tell simply by examining the file system?

I am fairly confident it is either Vista or Windows 7. There is a small chance it is Windows Server 2008.

14

Your best bet is going to be finding the properties of a Windows Executable (such as explorer.exe). In my case it's File and Product version is 6.1.7601.17567

6.0.xxxx.xxxxx will denote Windows Vista (with 6000, 6001 and 6002 being RTM, SP1 and SP2 respectively).

6.1.xxxx.xxxxx will denote Windows 7 (with 7600 and 7601 being RTM and SP1).

The same version numbers will apply for Windows server as well so I'm not sure how you'd tell the difference with those using this method.

20

Look at the file

C:\Windows\System32\License.rtf

Can be found for all these Windows operating systems

Vista, W7, W8, W8.1

These License rtf will have the Version of Windows and the Edition also, Windows 7 Pro for example.

Windows 10 has the rtf file but does not show edition, but if it has the arbitration clause note at the top you know it is W10, or use the explorer trick in Matthew Steeples answer.

  • 3
    This is especially nice for Linux users. – code_onkel Jul 20 '16 at 13:03
  • In Linux, you'll probably have to mount your Windows partition. You can use the blkid command, and look for TYPE="ntfs". In my case, its /dev/sda2. Then: sudo mount -t ntfs /dev/sda2 <your mount point>. You can look at the rtf file with libreoffice. – AAAfarmclub Oct 4 '18 at 0:30
  • On my dual boot system (Bunsen Helium and WINDOWS 7 HOME PREMIUM), it was lower case: license.rtf – AAAfarmclub Oct 4 '18 at 0:35
  • Same here on a windows 7 ultimate. Very important note because Linux is case-sensitive and often sorts that way as well. – Arlen Beiler Nov 19 '18 at 4:57
8

Using the registry you can look up version and edition

I found this answer over at Stackoverflow to the question Determine Windows Version, Edition and Service Pack OF AN OFFLINE DISK IMAGE

Use the values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. I presume you know where to find that hive?! The respective hive can be found under %SystemRoot%\System32\config with the name SOFTWARE.

Side-note: you can attempt to verify your results by looking at some well-known files (e.g. kernel32.dll, ntdll.dll) and into their version information resource (what you're looking for is the file version: with, e.g. GetFileVersionInfo()).

Edition values, if that's needed, can be found at HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions.

More specifically, how to load the hive of another registry:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/regedit_load_hive.mspx?mfr=true

  • -1 OP mentioned it won't boot making viewing the registry quite tricky... – HaydnWVN Nov 30 '11 at 16:54
  • 4
    You can load a different hive into regedit, I'm fairly sure. If not, I bet there's a tool that can do it. – Rob Nov 30 '11 at 16:56
  • +1, as that's what I use all the time. I load up Magic Jellybean Keyfinder, and point to the Windows folder to read the registry. Tells me what version and edition – Canadian Luke Nov 30 '11 at 17:15
  • +1 very kewl. i knew how to find the windows version....but the edition location is awesome! you rock! – ThaKidd KG5ORD Jul 21 '17 at 20:19
5

If you can still run executables from that filesystem, you can run C:\Windows\System32\winver.exe

  • 3
    Wouldn't that just give you the version that you run winver.exe on? – Rob Nov 30 '11 at 16:56
  • I ran it and it gave me the correct version of Windows (home premium, starter, etc.), which build, which service pack, and whom the version of windows was licensed to. – Yzmir Ramirez Jul 1 '12 at 15:00
5

If you have Linux on the same system, you could boot into Linux, ensure the Windows partition is mounted (for instance here it's in /mnt/C) and then do strings /mnt/C/Windows/System32/ntoskrnl.exe 2>/dev/null | grep amd64. For me in printed 9600.18258.amd64fre.winblue_ltsb.160303-0600, and googling for winblue indicates that this was the code name for Windows 8.1.

  • +1 This the best way I've found to get the Windows 10 version. The string has the build number at the start - in my case 14393 (14393.351.amd64fre.rs1_release_inmarket.161014-1755). Looking at the Windows 10 release info, that corresponds to version 1607. – wjandrea Mar 3 '18 at 3:31
1

Open the file bootmgr in notepad it is located on the hard drive you are wanting to know the version of it will be a hidden file so select show hidden files in folder options sorted

  • This is a 300 KB+ binary file and I did not find anything about windows version in this. – Jerther Aug 10 '17 at 14:50
1

If you don't have a running Windows and want to find the information from a Linux machine, you can use hivexget to read the registry file on the disk.

For Debian-based systems, install it with sudo apt install libhivex-bin.

Example (with grep to make the output shorter):

# hivexget /mnt/tmp/WINDOWS/system32/config/software 'Microsoft\Windows NT\CurrentVersion' \
| egrep 'ProductName|CSDVersion|"ProductId'
"ProductName"="Microsoft Windows XP"
"CSDVersion"="Service Pack 3"
"ProductId"="76487-OEM-0011903-00101"

Remove the | egrep ... part to see all values under that key.

0

Get Magical Jelly Bean Keyfinder. The portable free version works fine. Safest to get it from their website magicaljellybean.com or sofpedia etc.

Start it up. Under the tools menu, select >> load hive. It then shows all your drives, select the windows folder of the drive in question. It instantly provides the version and keys.

  • Magical Jelly Bean Keyfinder is known to report the incorrect license key. It also is nagware, that only works correctly, if you purchase it. It also isn't required to determine which instalation of Windows is on a filesystem, much easier ways, then using that nagware like Magical Jelly Bean Keyfinder which did I mention doesn't even work? – Ramhound Oct 31 '16 at 20:52
  • 1
    I've used it for years, never any nags or ads. You must have got a hijacked version. The issue here is not about keys, but getting the exact version of Windows, which keyfinder reports accurately.. It requires 0 expertise, 0 hunting for ini files or hive entries and gives you a complete answer in seconds effortlessly without trying to figure out product code or match version data.. If you had a better/easier solution why not describe it. – fred64 Oct 31 '16 at 21:25
  • Nope; Got it straight from the publisher whom signed the executable – Ramhound Oct 31 '16 at 22:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.