Differences

This shows you the differences between two versions of the page.

--- software:microsoft:windows:info [2017/02/17 03:51] – superwizard
+++ software:microsoft:windows:info [2019/10/22 05:27] (current) – [what version of Windows is installed on a hard drive] superwizard
@@ Line 29: / Line 29: @@
 <code>
-Look in the ../Windows/System32 folder for a file called "ntoskrnl.exe". If this file exists, it is at least an NT based system. (I assume you are not looking for Win95 or earlier.)
+Look in the ../Windows/System32 folder for a file called "ntoskrnl.exe".
+If this file exists, it is at least an NT based system. (I assume you are not looking for Win95 or earlier.)
 Now do a properties and examine the details for a product version.
@@ Line 50: / Line 51: @@
 Guess what, it tells you EXACTLY what system is installed. On that same drive above, this file
 said "WINDOWS 8 PRO"
+</code>
+Also: https://www.quora.com/How-can-I-tell-what-version-of-Windows-is-installed-on-a-hard-drive-without-booting-it
+<code>
+Arun Kumar, studied at University of Delhi
+Answered May 23, 2015
+You can try ProduKey (Page on cnet.com), it also shows the current version of
+installed Widows OS as well as MS Office and also shows the keys of installed programs.
+Similar tools can be found here: 27 Best Free Product Key Finder Software For Windows
+</code>
+Also: https://blog.skullsecurity.org/2010/find-the-windows-version-offline
+<code>
+Step 1: Get the registry hive
+This step is pretty simple. The file is called software and is located in %SYSTEMROOT%\system32\config.
+ You're going to have problems if you try grabbing this file from a running system, but fortunately we
+have an offline version of the harddrive. Copy that file to a USB stick, or some other device, following
+your standard evidence collection policies. I also recommend working from an image, not the live drive,
+ if you're doing actual forensic work.
 </code>