16

I have a dead Windows install in one of my partitions. It doesn't have any boot data anymore. Practically, it is only a filesystem dump. But I have access to read any files on its filesystem.

How could I identify which Windows version is it? In the ideal case, I think there should be some configuration setting or any file unique to the different Windows versions. For example, on Debian-based Linux distros, I could simply read /etc/debian_version.

Unfortunately, I have access only to a Linux box to reach its hard disk. So, solutions requiring a Windows (for example, digging in the version of ntoskrnl.exe, or checking some registry settings) aren't in my case, feasible.

Improve this question
10
  • 5
    Unfortunately, this question didn't contain the answer I require. The solution I've found was that the C:\Windows\System32\License.rtf contains the windows version.
    – peterh
    Commented Jul 11, 2015 at 3:11
  • 1
    @Moab My question is Linux-specific, while the other has only windows-specific answers.
    – peterh
    Commented Jul 11, 2015 at 14:00
  • 3
    I wish this question was de-duplicated, indeed the other question requires a working Windows installation, while this one is about Linux. I found that this answers the question: strings ./Windows/System32/ntoskrnl.exe 2>/dev/null | grep amd64. For me in printed 9600.18258.amd64fre.winblue_ltsb.160303-0600, and googling for winblue indicates that this was the code name for Windows 8.1.
    – David Faure
    Commented Jun 26, 2016 at 15:39
  • 3
    Too bad this is marked as duplicate. To get the info from Linux, it can be done with hivexget. I added the details to that other question : superuser.com/a/1383325/53547
    – mivk
    Commented Dec 13, 2018 at 15:15
  • 2
    Yeah, it's a shame it was closed. Else I'd add this answer working for Ubuntu using chntpw: stackoverflow.com/a/71725634/1654116
    – Rasmus
    Commented Apr 3, 2022 at 11:56

2 Answers 2

Reset to default
9

Simple. Look at the version of <drive>:\Windows\System32\ntoskrnl.exe

In the case of XP, look for <drive>:\boot.ini

If it is Vista+ you can look for the <drive>:\Boot folder.

For Windows 7+ you can look in device manager for the hidden System Reserved partition.

If there is a file named license.rtf in your C:\Windows\System32 folder, it also contains your current Windows version.

Improve this answer
8
  • 1
    Thank you very much! It is Win7+. The problem is that I don't have "System Reserved" partition any more. I have only the normal C:. How could I see the version of ntoskrnl.exe?
    – peterh
    Commented Jul 11, 2015 at 1:35
  • I finally solved by license.rtf, but your other solutions were also useful. Thank you very much!
    – peterh
    Commented Jul 11, 2015 at 1:42
  • @peterh for future reference, right-click, details. You will see info like (in my case: NT OS & Kernel. Version: 6.1.7601
    – td512
    Commented Jul 11, 2015 at 3:00
  • For ref: Microsoft Windows XP [Version 5.1.2600] (when starting cmd.exe)
    – Hannu
    Commented Jul 11, 2015 at 10:07
  • Err... ^- that is XP Pro "2002" SP 3 - 32bit, Microsoft Windows [Version 6.3.9600] is Windows 8.1 Pro (64 bit)
    – Hannu
    Commented Jul 11, 2015 at 10:42
0

You could also stream

strings cmd.exe | find "Version" might work too. Most files have the version of windows in their property sheet, which is visible in the raw binary near the end of it. One of these is the windows version. It's in unicode though.

Improve this answer
4
  • 3
    1) find "Version" is a windows thing, I have linux and use grep. 2) It gave only a cryptic xml data, the only version info was some like "5.1.0.0" which can be anything between winxp and win7. But your answer may be useful for the googlers of the future, so here is a +1.
    – peterh
    Commented Jul 11, 2015 at 4:44
  • You could load it in some sort of text editor or viewer, and look there, grep -i "Version" will do the same thing as windows 'find'.
    – wendy.krieger
    Commented Jul 11, 2015 at 7:05
  • 1
    find /i "search-data" == grep -i "search-data".
    – Hannu
    Commented Jul 11, 2015 at 10:01
  • Cmd has no built-in version numbers that I could find. strings ntoskrnl.exe | grep 5.1 did the trick instead (of course every Windows version has its own major.minor build to search for)
    – mirh
    Commented Oct 15, 2020 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .