DFIRHub

Windows registry artifactSystem Info (Historical)

Historical location of %SystemRoot% Environment Variable

  • System Info
  • 18 keys
  • SYSTEM

Registry keys

18 keys that RECmd reads for this artifact

  • SYSTEMSystemRoot
    Setup\Source OS*

    Historical location of %SystemRoot% Environment Variable

  • SYSTEMRegisteredOwner
    Setup\Source OS*

    Historical registered owner

  • SYSTEMRegisteredOrganization
    Setup\Source OS*

    Historical registered organization

  • SYSTEMDisplayVersion
    Setup\Source OS*

    Historical milestone update version

  • SYSTEMInstallTime
    Setup\Source OS*

    Historical OS install time

  • SYSTEMProductName
    Setup\Source OS*

    Historical OS name

  • SYSTEMInstallDate
    Setup\Source OS*

    Historical OS install date

  • SYSTEMInstallationType
    Setup\Source OS*

    Historical OS installation type

  • SYSTEMEditionID
    Setup\Source OS*

    Historical OS version and install info

  • SYSTEMCurrentMajorVersionNumber
    Setup\Source OS*

    Historical OS version and install info

  • SYSTEMCurrentBuildNumber
    Setup\Source OS*

    Historical OS version and install info

  • SYSTEMCurrentBuild
    Setup\Source OS*

    Historical OS build information

  • SYSTEMCompositionEditionID
    Setup\Source OS*

    Historical OS license type

  • SYSTEMBuildLab
    Setup\Source OS*

    Historical OS build information

  • SYSTEMBuildLabEx
    Setup\Source OS*

    Historical OS extended build information

  • SYSTEMReleaseID
    Setup\Source OS*

    Historical OS Release ID - Deprecated in Windows 10 21H1 and Newer (Shows 2009)

  • SYSTEMCSDVersion
    Setup\Source OS*

    Historical OS Service Pack Number

  • SYSTEMUBR
    Setup\Source OS*

    Historical OS Update Build Revision Number

References

3 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)