Skip to content
USBForensics

Glossary

MountedDevices

The SYSTEM hive key mapping drive letters and volume GUIDs to the disk or device each volume belongs to.

MountedDevices is a key at the root of the SYSTEM hive, SYSTEM\MountedDevices, where the Windows mount manager records which volume each drive letter and each volume GUID belongs to. It has two kinds of values: \DosDevices\E: for drive letters and \??\Volume{GUID} for volume GUIDs. The binary data identifies the volume: for removable media, a UTF-16 device path such as _??_USBSTOR#Disk&Ven_…#<serial>&0#{53f56307-…}; for an MBR fixed disk, a 12-byte disk signature and partition offset; for a GPT disk, DMIO:ID: followed by the partition GUID.

Why it matters in investigations

MountedDevices is the bridge between the device and the user. Values with identical data describe the same volume, so grouping them gives a USB device its drive letter and its volume GUID. The volume GUID then leads to each user's MountPoints2, and the drive letter helps attribute ShellBags and other per-user artifacts that only know a letter.

Two cautions:

  • Only the last device to receive a letter keeps its \DosDevices value. A stick that was once E: loses that value when another device gets E:, while its volume GUID value usually remains. A letter here says nothing about earlier connections.
  • The key has no per-value timestamp. The key's own last-write time only shows when some value last changed.

Example

SYSTEM\MountedDevices
  \??\Volume{7d3f8a2c-5e1b-11f1-9c4a-806e6f6e6963}
      _??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
  \DosDevices\E:
      _??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
  \DosDevices\C:
      12 bytes: MBR disk signature + partition offset

Both Contoso values carry the same device path, so serial CS1234567890 was last mounted as E: with volume GUID {7d3f8a2c-…}. C: is an internal disk, identified by its signature rather than a serial.

USB Forensics groups MountedDevices values by data and adds the letter and GUID to each device card. The complete USB artifact map shows where this key fits.