Partition/Diagnostic event 1006

Partition/Diagnostic event 1006 is written to the Microsoft-Windows-Partition/Diagnostic log each time a disk arrives, on Windows 10 1703 and later, where the channel is enabled by default. The log file is C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx. Each record describes the disk: Manufacturer, Model, Revision, SerialNumber, ParentId (the USB device instance), BusType, Capacity, the partition style and table, and the raw Mbr and Vbr0…Vbr3 boot records as binary data.

Why it matters in investigations

It is the richest single USB source on modern Windows. The registry keeps only the last arrival and removal; the 1006 log keeps every arrival it still holds, with the disk's identity attached.

The volume boot records are the key. Decoding Vbr0 gives the file system and the volume serial number, the value that shortcuts and Jump Lists store, so 1006 connects a physical device to the files opened on it. If one device shows two volume serial numbers across its events, it was reformatted between them.

Practitioner research also reports a second 1006 with a capacity of zero when the disk is removed, which gives connection windows. Confirm removals with other sources where you can.

Limits: the log rolls over; the field list varies between builds, so read fields by name; and SerialNumber is the storage serial, which can differ from the USB serial in USBSTOR. ParentId is the reliable link to Enum\USB.

Example

Event 1006 · Microsoft-Windows-Partition/Diagnostic · 2026-09-14 10:30:15 UTC
  Manufacturer  Contoso
  Model         SecureFlash
  ParentId      USB\VID_3F10&PID_4C21\CS1234567890
  BusType       7            (USB)
  Capacity      32015679488
  Vbr0          EB 76 90 45 58 46 41 54 20 20 20 …   (OEM "EXFAT   ")
                bytes at 0x64: A2 51 9D 3C  →  VSN 3C9D-51A2

The ParentId names the USB device, and the exFAT boot record gives volume serial number 3C9D-51A2.

Volume serial number (VSN): what the boot records reveal.
Device instance ID: the form used in ParentId.
Device property timestamps: the registry's last arrival, to compare with the newest 1006.
EMDMgmt: another source pairing a device with its VSN.

USB Forensics decodes every 1006 record and extracts the VSN from each boot record. The full walkthrough is in Partition/Diagnostic 1006.

Why it matters in investigations

Example

Related terms