Identifying an unknown Windows hard disk - reading Windows file versions in Linux
What do you do when you have an unkown Windows hard disk or partition, that you don't want to boot or that is unbootable? How do you identify the Windows version installed on the hard disk or partition? In Linux, we are used to mount the hard disk and then look at /etc/issue, /etc/redhat-release or something similar. You can even see the kernel version in the file names of the installed kernel images in /boot. But for a Windows OS? Well, you could look at the version of ntoskrnl.exe, for instance. Here are the version numbers for different versions of Windows [1]: 4.x: NT 4.x 5.0: Windows 2000 5.1: Windows XP 5.2: Windows 2003 Server (and R2), Windows XP 64-bit 6.0: Windows Vista, Server 2008 6.1: Windows 7, Server 2008 R2 6.2: Windows 8, Server 2012 6.3: Windows 8.1, Server 2012 R2 10.0: Windows 10, Server 10 So just mount the hard disk/partition and then look for C:\Windows\System32\ntoskrnl.exe. But how do you read the version number of a Portable Executable (PE) f...