Mounted devices
The mounted devices settings are stored in the key:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
Note that the mounted devices settings are also referred to as “Mount manager’s persistent name database”.
Seen on:
Windows 2000
Windows XP
Windows 2003
Windows Vista
Windows 2008
Windows 7
Windows 8.0
Windows 8.1
Windows 10
Windows 11
Values:
Name | Data type | Description |
---|---|---|
%IDENTIFIER% | REG_BINARY |
Where the following variants of %IDENTIFIER% can be used:
“\DosDevices\C:” - drive letter that is assigned to the root of a file system
“\DosDevices\F:\path\name” - drive letter that is assigned to a specific directory within a file system (has not been observed)
“??\Volume{01234567-89ab-cdef-0123-456789abcdef}” - unique volume identifier used within the Windows Kernel-Mode Object Manager
“#{01234567-89ab-cdef-0123-456789abcdef}” - purpose current unknown
Where the value data consist of either:
Device string value data
GPT partition value data
MBR partition value data
Device string value data
The device string value data is variable of size and consists of:
Offset | Size | Value | Description |
---|---|---|---|
0 | ... | UTF-16 little-endian encoded string, without an end-of-string character |
For example:
\??\FDC#GENERIC_FLOPPY_DRIVE#6&12345678&0&0#{01234567-89ab-cdef-0123-456789abcdef}
\??\IDE#CdRomQEMU_QEMU_DVD-ROM_______________________1.6.____#5&12345678&0&0.1.0#{01234567-89ab-cdef-0123-456789abcdef}
\??\SCSI#CdRom&Ven_VBOX&Prod_CD-ROM#4&0123456&0&010000#{01234567-89ab-cdef-0123-456789abcdef}
_??_USBSTOR#Disk&Ven_Generic&Prod_Flash_Disk&Rev_8.07#01234567&0#{01234567-89ab-cdef-0123-456789abcdef}
GPT partition value data
The GPT partition value data is 24 bytes of size and consists of:
Offset | Size | Value | Description |
---|---|---|---|
0 | 8 | "DMIO:ID:" | Signature, where DMIO is presumed to refer to Disk Manager I/O Driver |
8 | 16 | GUID Partition Table (GPT) partition identifier (little-endian GUID) |
MBR fixed-disk value data
The MBR partition value data is 12 bytes of size and consists of:
Offset | Size | Value | Description |
---|---|---|---|
0 | 4 | Master Boot Record (MBR) Disk identity (signature) (also referred to as disk identifier) | |
4 | 8 | Offset of the partition, in bytes, that contains the previously mounted file system |
Notes
The Windows mountvol.exe
command-line tool can show information about mounted and unmounted
devices. Its PowerShell equivalant is Get-Volume
.
Entries of volumes that are not presently mounted can be removed from the database with:
mountvol /r