Skip to content
USBForensics

Glossary

WPDBUSENUM

The Windows Portable Devices enumerator: SWD\WPDBUSENUM registry entries whose FriendlyName is a USB volume's label or drive letter.

When a removable volume mounts, Windows creates a portable-device node under SYSTEM\…\Enum\SWD\WPDBUSENUM, often named after the USBSTOR path, and a matching key in SOFTWARE\Microsoft\Windows Portable Devices\Devices. Its FriendlyName is the volume label, or the drive letter (E:\) when the volume has no label.

It is one of the few registry places that keeps a volume label. MTP phones and cameras appear here too.