Identifying an unknown Windows hard disk - reading Windows file versions in Linux

What do you do when you have an unkown Windows hard disk or partition, that you don't want to boot or that is unbootable? How do you identify the Windows version installed on the hard disk or partition?

In Linux, we are used to mount the hard disk and then look at /etc/issue, /etc/redhat-release or something similar. You can even see the kernel version in the file names of the installed kernel images in /boot.

But for a Windows OS? Well, you could look at the version of ntoskrnl.exe, for instance.

Here are the version numbers for different versions of Windows [1]:

4.x: NT 4.x
5.0: Windows 2000
5.1: Windows XP
5.2: Windows 2003 Server (and R2), Windows XP 64-bit
6.0: Windows Vista, Server 2008
6.1: Windows 7, Server 2008 R2
6.2: Windows 8, Server 2012
6.3: Windows 8.1, Server 2012 R2
10.0: Windows 10, Server 10

 So just mount the hard disk/partition and then look for C:\Windows\System32\ntoskrnl.exe.

 But how do you read the version number of a Portable Executable (PE) file in Linux? You could extract it with hexdump -C and search for the version number (in hex!), but that is quite awkward. There are supposedly some PE tools for linux, but I couldn't find any in Fedora repositories.

 A simple way is to use Wine and a Windows tool to check the header of the PE file, for instance Sysinternal's SigCheck tool [2].

wine sigcheck -q -n ntoskrnl.exe
6.2.9200.16424 (win8_gdr.120926-1855)

In this case, the Windows version is Windows 8 (or possibly Server 2012 R2). 

Telling the difference between Server and Workstation is harder. I don't know how to do that without Windows running (when you could programmatically check for OSVERSIONINFOEX.wProductType != VER_NT_WORKSTATION for a server OS, at least for Server 2008 and later).
Update. I have since discovered another tool, ExifTool [3] that is able to read PE headers and display version number. On Redhat/Fedora this is available as perl-Image-ExifTool. 
exiftool ntoskrnl.exe |grep 'File Version  '
File Version             : 6.1.7601.23677 (win7sp1_ldr.170209-0600)

[1] https://msdn.microsoft.com/en-us/library/ms724832%28VS.85%29.aspx
[2] https://technet.microsoft.com/en-us/sysinternals/bb897441.aspx

[3] http://www.sno.phy.queensu.ca/~phil/exiftool/

Kommentarer

Skicka en kommentar

Populära inlägg i den här bloggen

Steelseries Arctis 7 headset in Linux

Bild
UPDATE. This headset works without modifications in Linux after the changes were committed to pulseaudio in 2017.  The Steelseries Arctis series headsets are very comfortable. You can wear this headset all day long thanks to the comfortable head strap. Steelseries Arctis 7 There are three models, Arctis 3, 5 and 7. The last one is the most expensive and has wireless connection. Arctis 5 is basically the same without wireless (only USB connection). Arctis 3 has only analog inputs. I've got the Arctis 7 model and of course I'm using it with Linux. There were some issues setting it up. It works fine in Alsa, the device is recognized. You do have to adjust sound levels, at least the mic has too low sound level. Use alsamixer on command line to adjust all volume levels for the headset to 100% (the two outputs and one input). But Pulseaudio has some issues. Only the mono device (chat output) and microphone is visible. This is because the headset uses a non-supported co...
Läs mer

Hard disk Firmware update on the Linux command line

Sometimes you will find that your hard disk is slow, or there are some other issues with disk performance. If you are lucky, the disk is not broken. It could have some firmware bugs, and if you are even more lucky, the manufacturer could have issued a firmware update. I've updated several hard disk firmwares in the past. Usually you have to use a boot disk with DOS or something to update the firmware. Why updating firmware? One of my hard disks in the past needed a new firmware because it was dropping out from a RAID controller. It began working fine after the firmware update. The latest hard disk that needed firmware update was Seagate 15k.7 ST3450857SS SAS. I noticed that the disks sometimes slowed down during writes and even stalled. I use two 450GB disks in software RAID 1. By googling I found that there were other people having similar problems with the same disk and that there were actually a firmware update available from Seagate. Also Dell, HP and IBM seems to ha...
Läs mer

Using IBM ServeRAID M1015 card in Linux

Bild
The FusionMPT SAS2 based cards by LSI are cheap RAID cards that perform well in RAID 0 and 1 under Linux with SSDs and ZFS arrays. They are used in many 1U servers with one or two disks. They are also a popular SAS 6.0 / SATA III controllers for enthusiasts. You can get them cheap on ebay. Before SATA III was common on motherboards, this was THE card to get. It can still be useful if you need SAS disks or additional disks or have a need for disk enclosures. It is identical to the LSI MegaRAID SAS 9220-8i. The same hardware is also used in LSI 9240 and LSI 9211. It is possible to use the BIOS from another card (crossflashing) to change the features of the card. There are a few different BIOS files you can use. Specifications:  Official LSI information 8-lane, 5 GT/s PCI Express 2.0 Identical to LSI 9240-8i card 6 Gb/s per port Two x4 internal SFF-8087 connectors Controller LSISAS2008 Low cost SATA+SAS RAID solution RAID levels 0, 1, 5, 10, 50 and JBOD mode >...
Läs mer