Ok I was able to retrieve it using the following:
Download AC2T KeyViewer (http://www.ac2tech.com/tools/keyviewer/keyviewer.zip)
I used a password reset tool (Not sure what it was, it was just the one I've been using for years) which had a registry viewer on the boot CD. I navigated to
Microsoft->Windows NT->Current Version->DigitalProductId
Once I got that value (its really long, about 12 lines of hex), enter the whole thing into the 'Raw Key' tab of the KeyViewer application. It should spit out your Product Key. Note, this does not work in some versions of Windows Server.
Another alternative I've found is the following powershell script:
# create table to convert in base 24
$map="BCDFGHJKMPQRTVWXY2346789"
# Read registry Key
$value = (get-itemproperty "HKLM:\\SOFTWARE\Microsoft\Windows NT\CurrentVersion").digitalproductid[0x34..0x42]
# Convert in Hexa to show you the Raw Key
$hexa = ""
$value | foreach {
$hexa = $_.ToString("X2") + $hexa
}
"Raw Key Big Endian: $hexa"
# find the Product Key
$ProductKey = ""
for ($i = 24; $i -ge 0; $i--) {
$r = 0
for ($j = 14; $j -ge 0; $j--) {
$r = ($r * 256) -bxor $value[$j]
$value[$j] = [math]::Floor([double]($r/24))
$r = $r % 24
}
$ProductKey = $map[$r] + $ProductKey
if (($i % 5) -eq 0 -and $i -ne 0) {
$ProductKey = "-" + $ProductKey
}
}
"Product Key: $ProductKey"
In this script, you can replace the $value variable with the following:
- Locate the memory locations 34 to 42 in the registry value above from the machine that will not boot.
- Convert each pair of numbers to decimal (ie. A1=161)
- Build an array with those values eg. $value = (161,...)
Running the script then return your product key.
