Glossary
Volume serial number (VSN)
The 32-bit serial written into a volume's boot sector when it is formatted, shown as XXXX-XXXX and stored in shortcuts and Jump Lists.
A volume serial number (VSN) is a 32-bit value written into a volume's boot sector when the volume is formatted. Windows displays it as two groups of four hex digits, such as 3C9D-51A2, in vol and dir output. Its position depends on the file system: offset 0x43 on FAT32, 0x27 on FAT12/16, 0x64 on exFAT and 0x48 on NTFS, where the field is 8 bytes and Windows shows the low 4. The bytes are stored little-endian.
Why it matters in investigations
The VSN is the identifier that ties files to a physical device. When a user opens a file, the shortcut Windows writes records the VolumeID of the volume it was on: drive type, label and VSN. Jump Lists embed the same structure. If that VSN matches the one decoded from the device's boot record in Partition/Diagnostic 1006, or the one in EMDMgmt, the file was on that device, even if another stick later received the same drive letter.
Keep in mind what it is not:
- It belongs to the volume, not the hardware. Reformatting writes a new VSN, so one device can have several over its life. Two VSNs for the same device mean it was reformatted, and files opened under either one belong to the same stick.
- It can be changed with disk utilities, so treat it as strong but not tamper-proof evidence.
- Two unrelated volumes can, rarely, share a VSN; confirm with label and timing.
Example
exFAT boot sector, offset 0x64: A2 51 9D 3C
little-endian 32-bit value: 0x3C9D51A2
displayed by Windows: 3C9D-51A2
in EMDMgmt (decimal): …BACKUP_1016943010
in a shortcut's VolumeID: DriveType 2 (removable), Label BACKUP, Serial 3C9D-51A2
Four sources, one value: the boot record, EMDMgmt and the shortcut all point to the same volume.
Related terms
- Partition/Diagnostic event 1006: logs the boot record the VSN is read from.
- EMDMgmt: pairs a device serial with its VSN.
- Volume GUID: a different identifier, assigned by Windows rather than the file system.
- MountPoints2: the other per-user link to a device.
USB Forensics extracts VSNs from boot records, EMDMgmt, shortcuts and Jump Lists and joins them. Read Partition/Diagnostic 1006 for the decoding details.