EMDMgmt (Ready
USB volumes ReadyBoost tested, with the device serial, volume label and volume serial.
Use it to get the volume serial number and label of a USB volume, to show which stick a file in an LNK came from.
- SOFTWARE
- USB Devices
What It Is
ReadyBoost is the Windows feature that can use a USB flash drive as extra cache, and before it does it tests each newly connected volume and records it under EMDMgmt. Each test leaves the volume label and the volume serial number of a USB stick. The volume serial number also appears in LNK files, so it ties opened files to a particular stick. Windows skips ReadyBoost on machines with an SSD, so the key is often empty. It lives in SOFTWARE.
What It Proves
A volume with that label and volume serial number was connected on the device named in the subkey. The volume serial number also sits in LNK files, so it ties opened files to this stick.
What It Does Not Prove
Windows skips ReadyBoost on machines with an SSD, so the key is often empty or missing, and subkey times often change together, so they date little. The volume serial number is stored in decimal and must be converted to hex.
Where It Lives
EMDMgmt (ReadyBoost) lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| ReadyBoost tested the SanDisk stick, label CLIENTS, volume serial 2587644393. Its time, 2 Oct 2026 08:15 UTC, fits the first connection, so treat it as weak corroboration. |
| In hex the volume serial is 9A3C-51E9, the form LNK files and Jump Lists show. A file whose LNK carries it was opened from this stick. |
How to Read It
Each subkey names a tested volume, with the device serial, the volume label and the volume serial number. The volume serial number is stored in decimal, so convert it to hexadecimal, where 2587644393 becomes 9A3C51E9, which LNK parsers show as 9A3C-51E9. Treat the subkey times as weak, because they often change together.
- When Windows Writes It
- When ReadyBoost tests a newly connected volume.
- Which Windows Versions
- Windows Vista to 11, mostly on machines without an SSD
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (emdmgmt)
Hunt It
What ReadyBoost tested sits in this key, so parse SOFTWARE, or read it live with Velociraptor. The USB keys and LNK files corroborate the same stick by its serial.
Defender does not record ReadyBoost data. Parse the SOFTWARE hive.
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SOFTWARE - Parse With
- Registry ExplorerRECmdRegRipper (emdmgmt)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what EMDMgmt (ReadyBoost) shows.
- Windows Portable DevicesConfirms the stick's label from a key Windows fills in whether or not ReadyBoost ran.
- LNK Files with the Volume Serial and LabelNot in the RegistryCarries the same volume serial, so it names the files opened from this stick.
- Partition/Diagnostic Event 1006Not in the RegistryDates each connection, which these subkey times cannot.
Sources
The facts on this page come from these public pages, which say more on each point.