Glossary
EMDMgmt
A SOFTWARE hive key written by ReadyBoost that pairs a USB device's serial with its volume label and volume serial number.
EMDMgmt is a key in the SOFTWARE hive, SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt, written by ReadyBoost. When Windows evaluates a removable volume as a possible ReadyBoost cache, it creates a subkey for that volume. The subkey name is the device path of the disk, followed by the volume label, an underscore and the volume serial number in decimal.
Why it matters in investigations
EMDMgmt is one of the few places in the registry that puts a device serial and a volume serial number side by side. The volume serial number is what shortcuts and Jump Lists record for the files they point to, so an EMDMgmt entry can tie a file opened on E: to one physical stick, even after the drive letter was reused by another device.
It also keeps history. A reformatted device gets a new volume serial number, and often a new label, so the same device path can appear in several subkeys: one per volume that ReadyBoost evaluated. Two entries with the same serial and different volume serial numbers are strong evidence of a reformat.
Its limits:
- It is often absent on systems that boot from an SSD, where ReadyBoost is not used.
- The subkey's last-write time only approximates when the volume was last evaluated.
- The label may be empty or contain underscores; the volume serial number is always after the last underscore.
Example
SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\
_??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}BACKUP_1016943010
Reading it from the end: 1016943010 in decimal is 0x3C9D51A2, displayed by Windows as 3C9D-51A2; the label is BACKUP; the serial in the device path is CS1234567890. A shortcut whose VolumeID holds serial 3C9D-51A2 therefore points to a file that was on this Contoso stick.
Related terms
- Volume serial number (VSN): the value decoded from the subkey name.
- Device instance ID: the device path at the start of the name.
- Partition/Diagnostic event 1006: the other source of a device's volume serial number.
- WPDBUSENUM: another registry location that keeps the volume label.
USB Forensics decodes every EMDMgmt entry and links it to the device and to matching shortcuts. See which files were opened from a USB stick for how the serial is used.