Identify windows version by examining files?

[HCHTech]

So...you have a non-booting computer with an illegible COA sticker. Is it possible to determine what version of windows was installed by examining the files...say from a Linux live CD? Something like: Windows Vista Business 64-bit has a regedit.com file that is 16,045 bytes and dated 4/12/07. Windows 7 Home Premium 32-bit OEM has a regedit of 17,098 bytes dated 6/08/10. This is probably a bad example because the regedit file would undoubtedly be changed by service packs, etc.

I normally pull the drive mount it on a bench machine and use a product key puller, which works, but I was wondering if there was an easier way.

 

[NYJimbo]

D7 has the offline ops function for slaved drives. I dont know how much it will tell you but I know it will do its best to guess what O/S. I know it will also pull product keys. Maybe FoolishIT will be along with more info.

 

[compnet]

Mini xp/slave, keyfinder

 

[16k_zx81]

So...you have a non-booting computer with an illegible COA sticker. Is it possible to determine what version of windows was installed by examining the files...say from a Linux live CD? Something like: Windows Vista Business 64-bit has a regedit.com file that is 16,045 bytes and dated 4/12/07. Windows 7 Home Premium 32-bit OEM has a regedit of 17,098 bytes dated 6/08/10. This is probably a bad example because the regedit file would undoubtedly be changed by service packs, etc.

I normally pull the drive mount it on a bench machine and use a product key puller, which works, but I was wondering if there was an easier way.

Magic Jellybean Keyfinder
http://www.magicaljellybean.com/keyfinder/

If you're serious and have the budget,

Recover Keys
http://recover-keys.com/

 

[HCHTech]

Recover keys sounds like it might be interesting for one of my bench machines. $25 isn't a lot. I'm using a program called productkey now which will pull the keys for Windows & Office on a slaved drive.

If I could get the info without pulling the drive, I might be tempted not to do a drive test - so it's probably best to keep using my current method anyway

Thanks

 

[16k_zx81]

Recover keys sounds like it might be interesting for one of my bench machines. $25 isn't a lot. I'm using a program called productkey now which will pull the keys for Windows & Office on a slaved drive.

If I could get the info without pulling the drive, I might be tempted not to do a drive test - so it's probably best to keep using my current method anyway

Thanks

That would be for ONE pc

Enterprise license for 99+ PCs is 300 bucks.

 

[HCHTech]

I see. It doesn't look like their program will scan a slaved drive, but instead look for other computers on the network (the number of which would be determined by your licensing).

So this is off the table. I'll stick with my current procedure - it's working fine.

 

[16k_zx81]

I see. It doesn't look like their program will scan a slaved drive, but instead look for other computers on the network (the number of which would be determined by your licensing).

So this is off the table. I'll stick with my current procedure - it's working fine.

If I remember correctly, it does scan slaved drives.

[edit] yeah, it does.
http://prntscr.com/fbplb

 

[georgenoise]

Personally, I boot to a live version of Mini XP, fire up Magic Jellybean, load the hive and pull the key which tells me the key and type of OS. If it is a vista/7 machine I check the directory structure and if there is a "Program Files (x86)" you know it is a 64-bit system. After that you should have everything you need to move on.

 

[nextechinc]

Produkey works great for this as well. All you need is access to the registry hive, in whichever way your prefer. Usually we PXE boot to Trinity Rescue Kit, load up a guest share and gain access to the hive that way.