Differences

This shows you the differences between two versions of the page.

--- software:microsoft:windows:info [2019/10/22 05:24] – [what version of Windows is installed on a hard drive] superwizard
+++ software:microsoft:windows:info [2019/10/22 05:27] (current) – [what version of Windows is installed on a hard drive] superwizard
@@ Line 58: / Line 58: @@
 Arun Kumar, studied at University of Delhi
 Answered May 23, 2015
-You can try ProduKey (Page on cnet.com), it also shows the current version of installed Widows OS as well as MS Office and also shows the keys of installed programs.
+You can try ProduKey (Page on cnet.com), it also shows the current version of
+installed Widows OS as well as MS Office and also shows the keys of installed programs.
 Similar tools can be found here: 27 Best Free Product Key Finder Software For Windows
+</code>
+Also: https://blog.skullsecurity.org/2010/find-the-windows-version-offline
+<code>
+Step 1: Get the registry hive
+This step is pretty simple. The file is called software and is located in %SYSTEMROOT%\system32\config.
+ You're going to have problems if you try grabbing this file from a running system, but fortunately we
+have an offline version of the harddrive. Copy that file to a USB stick, or some other device, following
+your standard evidence collection policies. I also recommend working from an image, not the live drive,
+ if you're doing actual forensic work.
 </code>