Determine Windows Version, Edition and Service Pack OF AN OFFLINE DISK IMAGE
Solution 1
Use the values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
. I presume you know where to find that hive?! The respective hive can be found under %SystemRoot%\System32\config
with the name SOFTWARE
.
Side-note: you can attempt to verify your results by looking at some well-known files (e.g. kernel32.dll
, ntdll.dll
) and into their version information resource (what you're looking for is the file version: with, e.g. GetFileVersionInfo()
).
Edition values, if that's needed, can be found at HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions
. See here.
Solution 2
Everything you want is in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
.
However, I believe these values can be faked, so be cautious.
unixman83
I am a computer programmer. My favorite programming languages are C++, and Perl.
Updated on April 19, 2020Comments
-
unixman83 about 4 years
Using the registry alone, how does one detect: The Windows Version (XP, Vista, 7). The Edition (Home Premium, Professional, Ultimate). And The Service Pack level (Beta, RTM, SP1, SP2).
This is because I am repairing on offline system. The Registry of offline systems can be mounted and accessed.
-
user541686 about 13 yearsEditionID, CSDVersion, BuildLab, Product Name, etc... there's a lot of redundancy there, and I think none of them is foolproof. Probably the most descriptive is BuildLab; for me it's:
7601.win7sp1_rtm.101119-1850
. You'll still need EditionID though (HomePremium
, etc.). -
unixman83 about 13 yearsis there a better way then? like querying the file version of some what system file?
-
0xC0000022L about 13 yearsthe latter can be found at
HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions
-
user541686 about 13 years@unixman83: Querying files (@STATUS's solution) will work for most things, but not for the edition (Home Premium vs Ultimate).
-
0xC0000022L about 13 years@unixman83: any well-known file will work. Make sure to verify it's a signed (and valid) version of the file. Which should be possible ever since XP. On 2000 I think not all were signed.
-
Nux over 4 yearsTo load a hive you use
regedit
. You can do this from any Windows machine and should not affect your installation. Just load the hive and choose some temporary name for a new branch. More here: zeda.nl/index.php/en/load-user-registry-hive-in-regedit