Without know which Operating System your image was running you cannot possibly hope to carry out a comprehensive investigation. So my next couple of posts will be very short ‘quick wins’ of where to get some critical data. Starting with the Operating System version:

I recommend simply using Registry Viewer for this one, the data is stored in plain text and is easy to read/understand. You will need to open the Software Hive and browse to the following Key

SOFTWARE\Microsoft\Windows NT\CurrentVersion and look for ‘ProductName’

With Windows 8 there is no ‘CSDVersion’ as we have seen with previous versions to dictate service pack. It is theorised that Microsoft have moved away from Service Packs in favour of this new decimal system in order to allow a ‘mandatory update’ policy with a much shorter time-span than Service Packs in order to avoid the two-year support window service packs brought.

Previous version of Windows use the same Key path to determine the Windows versions, but the will also include ‘CSDVersion’ to allow for service pack identification.