Determine windows server version and service pack from filesystem using a Mac

Question

I have a vhd disk image of a Windows Server which I have managed to mount on my mac using Parallels.

The mounted vhd file contains the c: drive of the windows server.

I'm fairly sure that it was running Windows Server 2008. However I need to confirm this. And I also need to confirm which service pack was installed.

Does anyone know of a way of doing this just by examining the files on the file system.

Cheers

Solution

I don't believe the OS version is stored anywhere in the file system, this information is stored in the Windows Registry. ('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' to be exact)

You could however take a look at some of the system files on the file system. Use \Windows\Explorer.exe file information perhaps? The first 3 octets of the File version property represent the Windows version aswell as the Windows build number.

• Windows Server 2008 would be '6.0.6000'
• Windows Server 2008 SP2 would be '6.0.6002'
• Windows Server 2008 R2 would be '6.1.7600'
• Windows Server 2008 R2 SP1 would be '6.1.7601'

Comments

[ajh]

Not sure... Am on a mac, the answers there all seem to require windows running.

[Ramhound]

@Gotschi - Your comment makes no sense. He is using a virtual machine, the fact OS X cannot write to a NTFS isn't important, the virtual machine has this ability.

[Gotschi]

oops i misunderstood the parallels part. Sorry...

[ajh]

Thanks for your answer. The disk is currently mounted on a mac. Any idea how to check the version information on a mac?

[Robula]

Not sure, I've only used a Mac only a few times in my life. Using Finder you could navigate to the mounted Windows partition, then to the Windows directory then you could Apple+Click (Or however you right-click) on Explorer.exe and select 'Get Info'?

[ajh]

Just tried. Can see a whole lot of mac type info, but not the windows type of info that I need...

[Robula]

So no file version there? I don't think it's possible to mount the Windows registry from Mac so browsing the registry isn't an option, there are ways in Linux though.

[Ramhound]

@Ben - You won't be able to load the registry Hive using a OS X tool to get the information you want. The simplest way would be to load one of the FREE windows virtual machines provided by Microsoft, attach a copy of the .VHD file, then load the Hive located on the attached virtual hdd.

[erik]

Strange, here Windows 7 has CurrentVersion 6.1, CurrendBuild 7600 and BuildLabEx 7600.16385.amd64fre.win7_rtm…