I have a list of files taken from a dead system, but not the actual files themselves, or any other information (e.g. properties) that would indicate the OS version. Is there a way to determine the version of the OS based on the presence of particular files?

For example, if a particular file introduced in Windows XP SP2 is found, but a file introduced in Windows XP SP3 is not, you could conclude that it was XP SP2.

I can't find any information as to what files would be useful indicators online, though, and the methods of determining windows version for a dead system require the files themselves.

  • 1
    I doubt there's much existing documentation for this use case. If you have a single file list and a rough estimate, I suggest you install a couple of versions of Windows in a VM and diff the file lists yourself. Windows is, after all, quite fast to install. If you have a bunch of cases, you could even install a large bunch of Windows versions and create your own database. Sep 3 '20 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.