Glossary
Volume GUID
The identifier Windows assigns to each volume it mounts, as in \\?\Volume{…}; it links MountedDevices to each user's MountPoints2.
A volume GUID is the identifier the Windows mount manager assigns to each volume it mounts, in the form \\?\Volume{GUID}\. Drive letters are only convenient aliases; the volume GUID is the name Windows uses internally. It is recorded as a \??\Volume{GUID} value in SYSTEM\MountedDevices, whose data identifies the device or partition, and as a subkey name under each user's MountPoints2 in NTUSER.DAT.
Why it matters in investigations
The volume GUID is the key that says which account mounted which device. MountedDevices maps the GUID to a device path with a serial; MountPoints2 lists the GUIDs seen in each user's session. Join the two and a USB stick is tied to a user without relying on drive letters, which Windows reuses freely.
A few properties are worth knowing:
- The GUID is stable for a given device and partition on a given computer, so repeated connections of the same stick normally reuse it.
- It is generated per computer. The same stick gets a different volume GUID on another machine, so it cannot be used to match devices across systems; use the serial or the volume serial number for that.
- GUIDs of removable volumes often end in
806e6f6e6963, which helps spot them in a long list.
Example
SYSTEM\MountedDevices
\??\Volume{7d3f8a2c-5e1b-11f1-9c4a-806e6f6e6963} = _??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-…}
NTUSER.DAT (svc_backup)
…\Explorer\MountPoints2\{7d3f8a2c-5e1b-11f1-9c4a-806e6f6e6963}
The same GUID in both places: the Contoso stick was mounted in svc_backup's session. On a live system, mountvol lists the volume GUID paths currently known to the mount manager.
Related terms
- MountedDevices: the system-wide mapping of GUIDs to devices.
- MountPoints2: the per-user list of GUIDs.
- Device instance ID: the device path stored next to the GUID.
- Volume serial number (VSN): a different identifier, written in the file system.
USB Forensics resolves volume GUIDs to devices and names the users who mounted them. See which files were opened from a USB stick for the rest of the per-user picture.