Thursday 18 October 2018

data recovery - How to identify the Windows version of a dead install from Linux by having access only to its filesystem?



My question doesn't have an answer there, because all of them are windows-specific and I want a linux solution.


I have a dead windows install in one of my partitions. It doesn't have any boot data any more. Practically, it is only a filesystem dump. But I have access to read any files on its filesystem.


How could I identify, which Windows version is it? In ideal case, I think there should be some configuration setting or any file which is unique to the different Windows versions. For example, on Debian-based Linux distros I could simply read /etc/debian_version.


How could I do the same on a Win?


Extension #1: Unfortunately, I have access only to a Linux box to reach its hard disk. So, solutions requiring a Windows (for example, digging in the version of ntoskrnl.exe, or checking some registry settings) aren't in my case feasible.



Answer



Simple. Look at the version of :\Windows\System32\ntoskrnl.exe


In the case of XP, look for :\boot.ini


If it is Vista+ you can look for the :\Boot folder.


For Windows 7+ you can look in device manager for the hidden System Reserved partition.


If there is a file named license.rtf in your C:\Windows\System32 folder, it also contains your current Windows version.


No comments:

Post a Comment

Where does Skype save my contact's avatars in Linux?

I'm using Skype on Linux. Where can I find images cached by skype of my contact's avatars? Answer I wanted to get those Skype avat...