• Find Windows Version of a Mounted Image

    Home » Forums » AskWoody support » Windows » Windows – other » Find Windows Version of a Mounted Image

    Author
    Topic
    #2644622

    Hey Y’all,

    FYI: I’m posting here because this applies to all versions of Windows or at least 10 & 11 as I don’t have any earlier versions to test.

    I was rummaging around in some old Image files and was curious as to which Windows version was active at the time the image was taken. I found out that you can glean that information in the DISM.log file located at d:\Windows\Logs.

    That file however is really big so I wrote a short PowerShell program to sift the file for the information. You just provide a drive letter of the mounted image and the program will do the heavy lifting. Note: this will also work on your C: drive if you like.

    Clear-Host
    
    $DrvLtr = Read-Host -Prompt "Enter Windows System Drive Letter"
    If ($DRvLtr.Length -eq 1) {
      $DRvLtr = "$($DRvLtr):"
    }
    If ($DrvLtr.Length -ne 2) {
      "$DrvLtr is an invalid specification use x or x: only."
      Exit
    }
    
    $DISMLogPath = "$DrvLtr\Windows\Logs\DISM"
    $DISMFile    = Join-path -Path $DISMLogPath -ChildPath "dism.log"
    
    $Log = Get-Content -Path $DISMFile
    $API = $Log | Select-String "API Version"
    $Last = $API[-1]
    $Last = $Last -split(":")
    $Vers = (($Last[4] -split("-"))[0])
    
    #----  OUTPUT ----
    CLear-Host
    $Vers = $Vers -replace("API Version","Windows Build:")
    "The Windows version mounted at $DrvLtr is:`n $Vers"
    

    Output:

    The Windows version mounted at D: is:
      Windows Build: 10.0.22621.1
    PS>
    

    Note: I tested this on both Macrium Reflect and Terabyte Image for Windows Images. Of course it shouldn’t make a different but it’s always good to check!

    I’ll probably pretty this up with dialog and message boxes and post it to my shared OneDrive folder at a later date. Let me know if you find it useful.

    May the Forces of good computing be with you!

    RG

    PowerShell & VBA Rule!
    Computer Specs

    • This topic was modified 1 month, 1 week ago by RetiredGeek.
    2 users thanked author for this post.
    Viewing 8 reply threads
    Author
    Replies
    • #2644655

      Interesting, RG!

      If I understand correctly, you’re mounting the Macrium or TBI image file to a drive letter, extracting the dism.log file, searching it for the last (ie, the most recent) instance of “API Version”, and interpreting that as the “Windows Build” number.

      Operating on the assumption that this should be the same dism.log file that’s in an installed OS (ie, not restricted to just backup images), I took a look at the dism.log files in some of my old VirtualBox VMs.

      I found the script does not work on Win7 or Win8 dism.log files, as they don’t contain “API Version” references. The closest they seem to come are lines with “OS Version”.

      Win10 dism.log files seem to contain both “API Version” and “OS Version” references. But what do you make of the circumstance when those are different, as in my W10-home.png example? Your script is deferring to the “API Version”, while the Windows “About” page seems closer to the “OS Version”.

       

    • #2644695

      That file however is really big

      Mine aren’t.  With my penchant for spelunking into Windows’ innards, I frequently consult the DISM log and the CBS log for insight into where I pooched it all.  To avoid having to wade through a bunch of extraneous (for my purposes, anyway) and useless info, I often open these logs in an elevated Notepad and delete them before I start my digging and delving.

      Always create a fresh drive image before making system changes/Windows updates; you may need to start over!
      We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.

      1 user thanked author for this post.
    • #2644705

      I’ve always just used these…

      Windows 10 and above…

      DISM /Get-WimInfo /wimfile:E:\sources\install.wim /index:1

      Note: Replace E: with your mounted drive letter. Extension can be .wim or .esd

      — or —

      Windows 7 and above…

      DISM /Get-WimInfo /WimFile:E:\sources\boot.wim /index:1

      • #2644742

        ONG,

        Here’s my testing on that:

        Your Command:

        Microsoft Windows [Version 10.0.19045.4046]
        (c) Microsoft Corporation. All rights reserved.
        
        C:\Windows\system32>DISM /Get-WimInfo /wimfile:W:\sources\install.wim /index:1
        
        Deployment Image Servicing and Management tool
        Version: 10.0.19041.3636
        
        Error: 3
        
        The system cannot find the path specified.
        
        The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
        
        C:\Windows\system32>DISM /Get-WimInfo /wimfile:W:\sources\install.esd /index:1
        
        Deployment Image Servicing and Management tool
        Version: 10.0.19041.3636
        
        Error: 3
        
        The system cannot find the path specified.
        
        The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
        
        C:\Windows\system32>
        

        So by the Get-WimInfo the image if restored would run Windows 10.
        Note: even though I entered drive W: it was searching in C:!

        Original Program Output.

        The Windows version mounted at W: is:
          Windows Build: 10.0.22621.2792
        PS>
        

        I modified my program to return both API and OS versions.

        The Windows version mounted at w: is:
          API Version 10.0.22621.2792 
           OS Version 10.0.22631.3155
        PS> 
        

        By my program the restored image would run Windows 11 in either case.

        A visual search of all the OS Version entries in the DISM.log file shows NO W10 entries,
        i.e. 10.0.19xxx.

        So who do you believe?

        And the answer is…

        Unfortunately, I just this morning retired that DellXPS8700 and replaced it with a MinisForum Venus UM790 Pro!

        If I get really curious I’ll have to bring it out of storage and do a restore just for funzies.

        However, I know it was running and has been running windows 11 for several months and the .mrimg file is dated 2/22/2024 so I’m pretty sure it will restore to Win 11 Pro.

        May the Forces of good computing be with you!

        RG

        PowerShell & VBA Rule!
        Computer Specs

        • #2644791

          So by the Get-WimInfo the image if restored would run Windows 10. Note: even though I entered drive W: it was searching in C:!

          On any Windows installation I’ve seen, there is no install.wim (or .esd), so nothing for Get-Wiminfo to decipher — hence the “system cannot find the path specified” error. That file is only found on the OS installation media. It won’t be in your .mrimg image.

          And I don’t think it was “searching in C:”, I think that line is merely telling you where the results of your attempt to run DISM have been logged — ie, in the dism.log of your host machine, not the dism.log inside your backup image.

           

          1 user thanked author for this post.
      • #2644789

        I’ve always just used these… Windows 10 and above… DISM /Get-WimInfo /wimfile:E:\sources\install.wim /index:1 Note: Replace E: with your mounted drive letter. Extension can be .wim or .esd


        @OldNavyGuy
        , I think you and RG are talking about two different things. Testing install.wim (or .esd) is a way to reveal the version of Windows that will be installed from an installation ISO, but RG’s script is for use on a post-install backup image made with Macrium Reflect, Terabyte Image, Aomei BackUpper, Easus ToDo Backup, et al. If you’ve used one of those programs to create periodic backup images on a computer that may have had the OS upgraded a few times, it’s easy to forget which OS version had been on the computer at the time a particular backup was created. That’s what RG’s script is designed to ferret out.

    • #2644747

      Interesting…

      I had no issues.

      Acts like it couldn’t find install.wim.

      Sure you had a install.wim…instead of install.esd on the ISO?

       

       

    • #2644834

      but RG’s script is for use on a post-install backup image

      The Windows version can be found in the properties for ntoskrnl.exe in C:\Windows\System32

      So to get it from a mounted drive letter…example Z:

      Get-ItemProperty Z:\Windows\System32\ntoskrnl.exe | Format-List

       

       

       

    • #2645137

      The Windows version can be found in the properties for ntoskrnl.exe in C:\Windows\System32

      For the curious, attached is a screenshot of my aforementioned Win10 Home VM, showing the System Information applet, the ntoskrnl.exe file properties, the Windows “About” page, and the dism.log. I don’t know enough to make sense of the differences.

      RG, would it be practical to extract the info from the registry key “HKLM\Software\Microsoft\Windows NT\CurrentVersion”? In addition to differentiating editions (e.g., Home vs. Pro), the “ProductName” and “CurrentBuildNumber” values seem to be relatively consistent across Windows versions since Windows 2000, and for Win10/11 the “DisplayVersion” looks additionally helpful.

      • #2645156

        DG,

        Using Images that are MOUNTED as a drive, which is what I started this thread about, does not have registry because Windows is not RUNNING on that drive. A mounted drive is just like an external disk you can read it but you’re not RUNNING it.

        Now, with the right software you could open and RUN an Image in a Virtual Machine which would then provide a registry to query thus making your suggestion workable.

        I hope I’m not being too obtuse here?

        May the Forces of good computing be with you!

        RG

        PowerShell & VBA Rule!
        Computer Specs

    • #2645216

      does not have registry because Windows is not RUNNING on that drive.

      It doesn’t have to be running…the registry hives are located in Windows\System32\config.

      You would use Get-ItemProperty…

      https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-entries?view=powershell-7.4#getting-a-single-registry-entry

       

       

    • #2645241

      Using Images that are MOUNTED as a drive, which is what I started this thread about, does not have registry because Windows is not RUNNING on that drive. A mounted drive is just like an external disk you can read it but you’re not RUNNING it.

      You can, in fact, browse a non-running registry hive. After mounting your image, launch regedit on your host machine, select the HKLM branch, then from the menus choose “File”, “Load Hive”. Navigate to your mounted drive letter, “\Windows\System32\Config\” folder, and select the SOFTWARE hive. Give it some temporary “handle” by which the registry can refer to it amongst the host’s registry branches, and you’re good to go. When you’re done, select the temporary branch and “Unload Hive” from the menus.

      I’m not fluent in PowerShell, so don’t know how much of that can be scripted — hence my question to you. I can’t tell for sure, but maybe the link OldNavyGuy provided has further details.

    • #2645240

      One way of getting to the mounted drive registry keys…

      1. On the C: drive, run regedit
      2. Highlight HKEY_LOCAL_Machine
      3. Select File > Load Hive and navigate to the mounted drive System32\config folder (i.e Z:\Windows\System32\config)
      4. Select SOFTWARE.
      5. It will ask you to give it a name…I named it TestHive.
      6. Expand HKEY_LOCAL_Machine. You should see TestHive in the expanded list.
      7. There are your mounted drive registry keys.
      8. When you’re done, highlight TestHive, select File > Unload Hive.
    Viewing 8 reply threads
    Reply To: Find Windows Version of a Mounted Image

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: