I'm sorry that I don't know how to do this. However, not that this is of any help to your friend now, but if he cares about the integrity of his files, he should use something more robust than checking to see if the file requires a license key. Storing MD5 hashes of the files on read-only media, Tripwire that runs and logs to another computer, etc. I mean, who's to say that the hacker didn't replace his files with other files that require a license key? That would defeat the check that you're trying to perform, but would leave hacked files in place of the good ones...