VolumeInfoCache

The label of the last volume Windows Search saw at each drive letter.

Use it to tie a drive letter to the label of the last volume mounted there, even for UASP and virtual disks.

SOFTWARE
USB Devices

What It Is

Windows Search keeps a small cache of the label of the last volume it saw at each drive letter. That ties a drive letter to the label of the last volume mounted there, and it covers UASP disks and mounted virtual disks that other keys miss. Only the last volume per letter is kept, and the service that writes it does not always run. It lives in SOFTWARE.

What It Proves

A volume with that label was the last one at that drive letter, around the subkey last write time. It also covers UASP disks and mounted virtual disks.

What It Does Not Prove

Only the last volume per letter is kept, and a volume with no label tells you little. Windows Search writes it, and servers often do not run that service.

Where It Lives

VolumeInfoCache lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows Search\VolumeInfoCache\<drive letter>

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in VolumeInfoCache, each with what it tells you
Registry Value	What It Tells You
`E:\VolumeLabel` `REG_SZCLIENTS`	The last volume at drive E was labelled CLIENTS, the SanDisk stick's label. That ties recent paths on E in LNK files and ShellBags to this stick.
`E:` `SubkeyLast write 15 Oct 2026 16:28 UTC`	Windows Search last saw a volume at drive E about 15 Oct 2026 16:28 UTC, when the stick connected. USBSTOR 0066 gives the same minute, so they agree.
`F:\VolumeLabel` `REG_SZT5_BACKUP`	A disk labelled T5_BACKUP was the last volume at drive F, and it is not in USBSTOR. Check Enum\SCSI, because it may be a UASP disk such as a Samsung T5.

How to Read It

There is one subkey per drive letter, and VolumeLabel holds the label of the last volume seen there. Match the label to Windows Portable Devices and to the volume labels in LNK files. Read the subkey's last write time as roughly when that volume was last seen, and compare it with USBSTOR 0066. DriveType says what kind of volume it was, with 2 removable, 3 fixed, 4 network and 5 optical.

When Windows Writes It: When Windows Search notices a volume at that drive letter.
Which Windows Versions: Windows 7 to 11
Tools That Parse It: Registry Explorer, RECmd, USB Detective

Hunt It

The label sits in this key, written by Windows Search, so parse SOFTWARE, or read it live with Velociraptor. The USB keys corroborate the same stick by its connection times.

Sees Related ActivityDeviceEvents (UsbDriveMounted)

Gives the same last device per letter from mount events, inside retention. It does not read VolumeInfoCache, so take the volume label from the key.

KQLDefender XDR, Advanced hunting

// The last USB drive mounted at each drive letter, with make and serialDeviceEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where ActionType == "UsbDriveMounted"| extend Fields = parse_json(AdditionalFields)| summarize arg_max(Timestamp, *) by DriveLetter = tostring(Fields.DriveLetter)| project Timestamp, DriveLetter, Manufacturer = tostring(Fields.Manufacturer), ProductName = tostring(Fields.ProductName), SerialNumber = tostring(Fields.SerialNumber)

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what VolumeInfoCache shows.

MountedDevicesNames the device that last held the drive letter, to pair with this label.
Windows Portable DevicesGives the serial of the stick with this label, which ties the label to a device.
Volume Label in LNK Files and Jump ListsNot in the RegistryShows files opened from a volume with this label, and when.

Sources

The facts on this page come from these public pages, which say more on each point.