Mounted
Which device last held each drive letter, and the volume GUID each volume was given.
Use it to link a drive letter and volume GUID to the device last mounted there, such as a USB stick by serial.
- SYSTEM
- USB Devices
What It Is
MountedDevices records which physical device last sat behind each drive letter, and the volume GUID, a unique identifier, that Windows gave each volume. It lets you link a drive letter such as E to the device that held it, a USB stick by its serial or an internal disk by its signature. The volume GUID is the thread that ties this key to a user, because the same GUID appears in that user's MountPoints2. It lives in the SYSTEM hive.
What It Proves
The device named in the data was the last one mounted at that drive letter, and it was given that volume GUID.
What It Does Not Prove
Only the last device per letter is kept. USB hard disks store a disk signature or partition GUID here rather than a serial.
Where It Lives
MountedDevices lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The SanDisk stick, serial 4C530001230619115412 |
| This volume GUID belongs to the same stick. Find it in a user's MountPoints2 to see who had the stick mounted. |
| Drive C holds the DMIO marker and a partition GUID, so it is the internal GPT disk, not a USB device. Rule it out when you list removable drives. |
How to Read It
Read the data of each \DosDevices value, such as \DosDevices\E:, as Unicode, because it names the USBSTOR device and serial. Find the \??\Volume{GUID} value with the same data, and that GUID leads to MountPoints2. Data that starts "DMIO:ID:" holds a GPT partition GUID, while data 12 bytes long is an MBR disk signature and offset.
- When Windows Writes It
- When a volume is mounted and given a drive letter or volume GUID.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, USB Detective
Hunt It
The letter a volume was given is not written to any standard Windows event log, so the live tools cannot show it. Parse the SYSTEM hive, or bring in the device events Defender records through its connector.
Shows which stick got which letter at each mount, inside retention. MountedDevices keeps only the last one per letter, but for far longer.
// Drive letters given to USB drives as they mountedDeviceEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what MountedDevices shows.
- USBSTOR and USB Device KeysGives the device's make, model and serial, and when it was connected and removed.
- MountPoints2Shows which user had the volume mounted, and when they last did.
- LNK Files with the Volume Serial and LabelNot in the RegistryShows which files were opened from that volume, matched by its serial and label.
Sources
The facts on this page come from these public pages, which say more on each point.