Skip to content
USBForensics

Glossary

MountPoints2

The NTUSER.DAT key listing volumes mounted in a user's session, by volume GUID: the registry link between a USB device and an account.

MountPoints2 is a key in each user's NTUSER.DAT, Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2, that lists the volumes mounted while that user was logged on. Each volume gets a subkey named after its volume GUID, such as {7d3f8a2c-5e1b-11f1-9c4a-806e6f6e6963}. Network shares appear as well, with names like ##server#share.

Why it matters in investigations

The system-wide USB artifacts (USBSTOR, MountedDevices, setupapi.dev.log, the event logs) never name an account. MountPoints2 does, because it lives in a user's own hive: if a volume GUID is listed there, that volume was mounted during that user's session. Match the GUID with MountedDevices to find the device path and serial, and you have a registry link between a physical device and an account.

The subkey's last-write time approximates the last time that user mounted the volume. It is a single timestamp, not a history, and should be confirmed with the user's shortcuts, Jump Lists or ShellBags.

Practical points:

  • Collect every profile's NTUSER.DAT. reg save only reaches logged-on users; KAPE, Velociraptor or an image reach the others.
  • A GUID with no match in MountedDevices cannot be resolved to a device from the registry alone.
  • The same device can appear in several users' hives; each one is a separate piece of evidence.

Example

C:\Users\svc_backup\NTUSER.DAT
  Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
    {7d3f8a2c-5e1b-11f1-9c4a-806e6f6e6963}      last written 2026-09-14 10:30:21 UTC

SYSTEM\MountedDevices
  \??\Volume{7d3f8a2c-5e1b-11f1-9c4a-806e6f6e6963}
      _??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-…}

The account svc_backup mounted the Contoso stick with serial CS1234567890, most recently around 10:30 UTC.

USB Forensics reads every user hive in a collection and names the accounts on each device card. See which files were opened from a USB stick for the other per-user artifacts.