WPDBUSENUM

WPDBUSENUM is the Windows Portable Devices enumerator. When a removable volume is mounted, Windows creates a software device node for it under SYSTEM\ControlSet00x\Enum\SWD\WPDBUSENUM, usually named after the disk's device path (_??_USBSTOR#Disk&Ven_…#<serial>&0#{53f56307-…}). A matching key appears in the SOFTWARE hive under Microsoft\Windows Portable Devices\Devices, named SWD#WPDBUSENUM#_??_USBSTOR#… in uppercase. In both places, the FriendlyName value is the volume label, or the drive letter (for example E:\) when the volume has no label.

Why it matters in investigations

WPDBUSENUM is one of the few registry locations that keeps a volume label. The label corroborates other sources: EMDMgmt, the VolumeLabel field of shortcuts and Jump Lists, and the boot records logged by Partition/Diagnostic 1006. When a label is missing, the drive letter in its place still helps attribute folder-level artifacts such as ShellBags.

The SYSTEM node carries a ContainerID, which ties it to the matching USBSTOR and USB nodes even when names differ. The SOFTWARE key has a last-write time that gives a rough idea of when Windows last updated the entry; treat it as approximate.

Entries whose name does not point to a USBSTOR path are portable devices rather than mass-storage volumes, for example some phones and cameras. They show that a device was connected, but not a mounted file system.

Example

SYSTEM\ControlSet001\Enum\SWD\WPDBUSENUM\
  _??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
      FriendlyName = BACKUP
      ContainerID  = {5c1e2a7d-8b34-4f0e-9d61-2a7c4e9b0f13}

SOFTWARE\Microsoft\Windows Portable Devices\Devices\
  SWD#WPDBUSENUM#_??_USBSTOR#DISK&VEN_CONTOSO&PROD_SECUREFLASH&REV_1.00#CS1234567890&0#{53F56307-…}
      FriendlyName = BACKUP

Serial CS1234567890 had a volume labelled BACKUP.

ContainerID: the link to the USB and USBSTOR nodes.
USBSTOR: the disk-side entry for the same serial.
EMDMgmt: another source of labels, with the volume serial number.
Device instance ID: the device path embedded in the key name.

USB Forensics reads both keys and adds labels and letters to each device. The complete USB artifact map shows how they fit with the other sources.

Why it matters in investigations

Example

Related terms