11

This question already has an answer here:

My question doesn't have an answer there, because all of them are windows-specific and I want a linux solution.

I have a dead windows install in one of my partitions. It doesn't have any boot data any more. Practically, it is only a filesystem dump. But I have access to read any files on its filesystem.

How could I identify, which Windows version is it? In ideal case, I think there should be some configuration setting or any file which is unique to the different Windows versions. For example, on Debian-based Linux distros I could simply read /etc/debian_version.

How could I do the same on a Win?

Extension #1: Unfortunately, I have access only to a Linux box to reach its hard disk. So, solutions requiring a Windows (for example, digging in the version of ntoskrnl.exe, or checking some registry settings) aren't in my case feasible.

marked as duplicate by Moab, fixer1234, DavidPostill, Windos, mdpc Jul 15 '15 at 0:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 4
    Unfortunately, this question didn't contain the answer I require. The solution I've found was that the C:\Windows\System32\License.rtf contains the windows version. – user259412 Jul 11 '15 at 3:11
  • It is still a duplicate question. – Moab Jul 11 '15 at 12:16
  • 1
    @Moab My question is Linux-specific, while the other has only windows-specific answers. – user259412 Jul 11 '15 at 14:00
  • 3
    I wish this question was de-duplicated, indeed the other question requires a working Windows installation, while this one is about Linux. I found that this answers the question: strings ./Windows/System32/ntoskrnl.exe 2>/dev/null | grep amd64. For me in printed 9600.18258.amd64fre.winblue_ltsb.160303-0600, and googling for winblue indicates that this was the code name for Windows 8.1. – David Faure Jun 26 '16 at 15:39
  • 2
    Too bad this is marked as duplicate. To get the info from Linux, it can be done with hivexget. I added the details to that other question : superuser.com/a/1383325/53547 – mivk Dec 13 '18 at 15:15
4

Simple. Look at the version of <drive>:\Windows\System32\ntoskrnl.exe

In the case of XP, look for <drive>:\boot.ini

If it is Vista+ you can look for the <drive>:\Boot folder.

For Windows 7+ you can look in device manager for the hidden System Reserved partition.

If there is a file named license.rtf in your C:\Windows\System32 folder, it also contains your current Windows version.

  • Thank you very much! It is Win7+. The problem is that I don't have "System Reserved" partition any more. I have only the normal C:. How could I see the version of ntoskrnl.exe? – user259412 Jul 11 '15 at 1:35
  • I finally solved by license.rtf, but your other solutions were also useful. Thank you very much! – user259412 Jul 11 '15 at 1:42
  • @peterh for future reference, right-click, details. You will see info like (in my case: NT OS & Kernel. Version: 6.1.7601 – td512 Jul 11 '15 at 3:00
  • For ref: Microsoft Windows XP [Version 5.1.2600] (when starting cmd.exe) – Hannu Jul 11 '15 at 10:07
  • Err... ^- that is XP Pro "2002" SP 3 - 32bit, Microsoft Windows [Version 6.3.9600] is Windows 8.1 Pro (64 bit) – Hannu Jul 11 '15 at 10:42
1

You could also stream

strings cmd.exe | find "Version" might work too. Most files have the version of windows in their property sheet, which is visible in the raw binary near the end of it. One of these is the windows version. It's in unicode though.

  • 1
    1) find "Version" is a windows thing, I have linux and use grep. 2) It gave only a cryptic xml data, the only version info was some like "5.1.0.0" which can be anything between winxp and win7. But your answer may be useful for the googlers of the future, so here is a +1. – user259412 Jul 11 '15 at 4:44
  • You could load it in some sort of text editor or viewer, and look there, grep -i "Version" will do the same thing as windows 'find'. – wendy.krieger Jul 11 '15 at 7:05
  • find /i "search-data" == grep -i "search-data". – Hannu Jul 11 '15 at 10:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.