Glossary
ContainerID
A GUID Windows gives to all device nodes that belong to the same physical device, linking Enum\USB, Enum\USBSTOR and SWD\WPDBUSENUM entries.
A ContainerID is a GUID that Windows assigns to every device node that belongs to the same physical device. One USB stick shows up as several nodes in the SYSTEM hive: the USB device under ControlSet00x\Enum\USB\VID_…&PID_…, the disk under Enum\USBSTOR, and a portable-device view of its volume under Enum\SWD\WPDBUSENUM. Each of these instance keys has a ContainerID string value, and for one physical device they all hold the same GUID.
Why it matters in investigations
Most of the time the device serial is enough to line up the USB and USBSTOR entries, because both instance names contain it. The ContainerID is the link that still holds when they do not. The classic case is a device with a Windows-generated serial: the USB node and the USBSTOR node then receive different made-up instance IDs, and only the shared ContainerID says they are the same reader or stick.
It also separates storage from everything else under Enum\USB. Hubs, mice, keyboards and webcams live there as well; a USB entry whose ContainerID matches a USBSTOR entry is the USB side of a storage device, with its vendor and product IDs.
One caution: internal and root devices share a null container, {00000000-0000-0000-ffff-ffffffffffff} (sometimes all zeros). That value must be ignored, otherwise unrelated hubs and controllers would be merged into a single "device".
Example
Enum\USB\VID_3F10&PID_4C21\CS1234567890
ContainerID = {5c1e2a7d-8b34-4f0e-9d61-2a7c4e9b0f13}
Enum\USBSTOR\Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00\CS1234567890&0
ContainerID = {5c1e2a7d-8b34-4f0e-9d61-2a7c4e9b0f13}
Enum\SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
ContainerID = {5c1e2a7d-8b34-4f0e-9d61-2a7c4e9b0f13}
FriendlyName = BACKUP
Three nodes, one GUID: a single Contoso stick whose volume is labelled BACKUP. The USB node adds the vendor and product IDs, the USBSTOR node the model and the property timestamps, and the WPDBUSENUM node the volume label.
Related terms
- USBSTOR: the disk-side node that the ContainerID links to.
- Device instance ID: the per-node name that normally carries the serial.
- WPDBUSENUM: the volume-side node, with the label.
- Windows-generated serial: the case where the ContainerID is the only link.
USB Forensics groups device nodes by serial and ContainerID in your browser and shows the registry key behind every link. For the full registry layout, read USBSTOR forensics.