Differences

This shows you the differences between two versions of the page.

--- software:microsoft:windows:info [2016/06/15 18:03] – [what version of Windows is installed on a hard drive] superwizard
+++ software:microsoft:windows:info [2019/10/22 05:27] (current) – [what version of Windows is installed on a hard drive] superwizard
@@ Line 1: / Line 1: @@
+====== Lost Product key PID from hard drive ======
+From: http://www.howtogeek.com/206329/how-to-find-your-lost-windows-or-office-product-keys/
+<code>
+The easiest way to get access to your product key is with a third-party utility, and there’s nobody
+better at those than NirSoft. Their utilities are always crapware-free, and are always really useful.
+The only issue with this particular utility is that some antivirus will detect it as a false positive,
+because some malware might try to steal your product key.
+</code>
+====== Ultimate PID Checker Determine valid PID validity check ======
+From: http://janek2012.eu/ultimate-pid-checker/
+<code>
+The Ultimate PID Checker is a compact and portable utility whose purpose is to verify the integrity
+of Windows serial numbers. You can use this tool if you are planning to reinstall your operating
+system, for instance, and are unsure of the current product key you have at hand.
+http://www.softpedia.com/get/System/System-Info/The-Ultimate-PID-Checker.shtml
+</code>
 ====== what version of Windows is installed on a hard drive ======
@@ Line 6: / Line 29: @@
 <code>
-Look in the ../Windows/System32 folder for a file called "ntoskrnl.exe". If this file exists, it is at least an NT based system. (I assume you are not looking for Win95 or earlier.)
+Look in the ../Windows/System32 folder for a file called "ntoskrnl.exe".
+If this file exists, it is at least an NT based system. (I assume you are not looking for Win95 or earlier.)
 Now do a properties and examine the details for a product version.
@@ Line 27: / Line 51: @@
 Guess what, it tells you EXACTLY what system is installed. On that same drive above, this file
 said "WINDOWS 8 PRO"
+</code>
+Also: https://www.quora.com/How-can-I-tell-what-version-of-Windows-is-installed-on-a-hard-drive-without-booting-it
+<code>
+Arun Kumar, studied at University of Delhi
+Answered May 23, 2015
+You can try ProduKey (Page on cnet.com), it also shows the current version of
+installed Widows OS as well as MS Office and also shows the keys of installed programs.
+Similar tools can be found here: 27 Best Free Product Key Finder Software For Windows
+</code>
+Also: https://blog.skullsecurity.org/2010/find-the-windows-version-offline
+<code>
+Step 1: Get the registry hive
+This step is pretty simple. The file is called software and is located in %SYSTEMROOT%\system32\config.
+ You're going to have problems if you try grabbing this file from a running system, but fortunately we
+have an offline version of the harddrive. Copy that file to a USB stick, or some other device, following
+your standard evidence collection policies. I also recommend working from an image, not the live drive,
+ if you're doing actual forensic work.
 </code>