I would like to know what MSI installed a given dll or exe on my system. I know that Windows fixes deleted files if they belong to an installed package. Can I query that information without actually deleting the file? Is there a tool or Win32 API to check what package a file belongs to?
It appears like there might be a way after all! I recently discovered registry entries for files installed by Windows Installers under the following subtree:
I wrote a small Python script to lookup the installer for a file using the information stored there:
> python windows-installer-file-search.py opus.dll File: C:\Program Files (x86)\Mumble\opus.dll Product: Mumble 1.2.13 Install user: S-1-5-18 Cached installer: C:\Windows\Installer\2f6b072.msi
It is available here: https://github.com/Zero3/windows-installer-file-search
If you are okay with just finding plausible needles in the haystack, this quick and dirty abuse of 7-Zip will work:
7z.exe l -an -air!C:\Windows\Installer\*.msi > needlelist.txt
needlelist.txt in any text editor, search for
needlename.dll and you will find the corresponding .msi package in the listings generated by 7-Zip.
(Note: This method is 'dirty' because it just tells you which .msi packages that contains a file named
needlename.dll. But it is probably fine for most use cases.)