You used to be able to download the recovery images directly from Agilent / Keysight via FTP, but they took it down a few years ago. There is a mirror of this FTP server on the internet archive. (
https://archive.org/download/ftp.keysight.com/) You don't need to download the whole tar; you can browse individual files directly. I attached a guide from Agilent regarding the general recovery procedures for this family of scopes.
Generally, the reason for the missing software is a dead (or, of course, missing) HDD (2.5" ide) or a dead CMOS Battery / a dead Dallas Time-Bomb in older versions, keeping the system from booting. So, replacing the HDD with a CF card is the way to go in most cases (4GB is plenty).
There are different motherboard variants in this scope, an older green one (using the Dallas RTC chip) and a newer brown one. Those aren't directly compatible driver wise, so not every recovery image works with every board. The scope part should be the same, though. (+ some older versions only had 16MB of RAM, later ones had 64MB)
There is already a big thread about this series of scopes on this forum containing a lot of information. (
https://www.eevblog.com/forum/testgear/agilent-54835a-scope-(4-channel-1ghz-4gss)-repair-uphack/)
The scope part can, sadly, only be checked if the Windows environment is fully up and running, so it's a gamble if you get a fully working unit. (If it then passes self-test and the self-calibration routines, it's generally fine) Repairing can be hard as well, because those acquisition ASICs are pretty much unobtanium.
Greetings,
Simon