Google Drive for Desktop (DriveFS)

The drive letter Google Drive for desktop mounts, and the account it belongs to.

Use it to tie a drive letter such as G to Google Drive, so paths on it read as cloud files rather than a local disk.

NTUSER.DAT
Office, Email and Cloud Apps

What It Is

Google Drive for desktop mounts a user's Google account files as a drive letter, and records that letter and the account it belongs to here. That tells you a drive letter such as G is cloud storage. Paths on it in LNK files, ShellBags and Jump Lists are then Google Drive files, not a local disk. It names the letter and account, not the files. It lives in the user's own NTUSER.DAT.

What It Proves

Google Drive for desktop ran for this user and mounted a Google account's files at that letter. Paths on that letter in LNK files, ShellBags and Jump Lists are Google Drive files, not a local disk.

What It Does Not Prove

It names the letter and an account ID, not the files, which are in the DriveFS databases under AppData\Local\Google\DriveFS. Older Drive File Stream versions used a MountPoint value instead.

Where It Lives

Google Drive for Desktop (DriveFS) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Google\DriveFS\Share

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Google Drive for Desktop (DriveFS), each with what it tells you
Registry Value	What It Tells You
`SyncTargets` `ValueG:\ with account ID 1a2b3c4d5e6f7081`	Google Drive for desktop mounted a Google account's files as drive G. Read paths on G in LNK files and ShellBags as files in Google Drive.
`Share` `SubkeyLast write 13 Oct 2026 18:04 UTC`	The share settings last changed 13 Oct 2026 18:04 UTC, which can mark setup or a new letter. Compare it with when GoogleDriveFS.exe first ran.
`G:\My Drive\Clients` `ShellBags pathFirst opened 13 Oct 2026 18:11 UTC`	alice first opened a Clients folder in Google Drive at 13 Oct 2026 18:11 UTC. Compare its files with those opened from E:\Clients, because the same data may be in both.

How to Read It

SyncTargets holds the drive letter, usually G:, and the account identifier. Match the identifier to the account folder under AppData\Local\Google\DriveFS. Treat paths on that letter in LNK files, ShellBags and Jump Lists as files in Google Drive.

When Windows Writes It: When Google Drive for desktop is set up, signs in or changes its drive letter.
Which Windows Versions: Windows 10 and 11 with Google Drive for desktop, formerly Drive File Stream
Tools That Parse It: Registry Explorer, RECmd

Hunt It

The mounted letter and account sit in this per-user key, so parse the hive, or read it live with Velociraptor. The DriveFS databases under AppData hold the files synced.

Sees Related ActivityDeviceProcessEvents

Shows Google Drive running for each Windows account. It does not record the drive letter or the Google account.

KQLDefender XDR, Advanced hunting

// Google Drive for desktop running, and as which accountDeviceProcessEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where FileName =~ "GoogleDriveFS.exe"| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by AccountName, FolderPath

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Google Drive for Desktop (DriveFS) shows.

ShellBagsShows folders the user browsed on the Google Drive letter.
DriveFS Databases in AppData\Local\Google\DriveFSNot in the RegistryLists the files the account holds and synced, which this key does not.

Sources

The facts on this page come from these public pages, which say more on each point.