Skip to content

Glossary

MountedDevices

The SYSTEM hive key mapping drive letters and volume GUIDs to the disk or device each volume belongs to.

SYSTEM\MountedDevices has values named \DosDevices\E: and \??\Volume{GUID}. For removable media the data is a device path such as _??_USBSTOR#Disk&Ven_…#CS1234567890&0#{53f56307-…}; for fixed disks, an MBR disk signature and offset or a GPT partition GUID.

Values with identical data belong to the same volume. Only the last letter assigned is kept, so a letter here says nothing about earlier connections. See the USB artifact map.