> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/usb-usage/drive-letter-and-volume-name.md).

# Drive Letter and Volume Name

This information can be used to trace file access, transfer activities, and to identify specific devices used during a session. The methods to discover this information vary across different versions of Windows.

### Key Identification

#### Artifact Locations

* **XP**
  * **USBSTOR for ParentIdPrefix**: `SYSTEM\CurrentControlSet\Enum\USBSTOR`
  * **MountedDevices for Last Mount Point**: `SYSTEM\MountedDevices`
* **Windows 7 and Above**
  * **Windows Portable Devices**: `SOFTWARE\Microsoft\Windows Portable Devices\Devices`
  * **MountedDevices for Drive Letters**: `SYSTEM\MountedDevices`
  * **VolumeInfoCache for Last USB Drive Letter**: `SOFTWARE\Microsoft\Windows Search\VolumeInfoCache`

#### Critical Information

* The `ParentIdPrefix` found under USBSTOR is essential for identifying the device in MountedDevices.
* In Windows XP, the `ParentIdPrefix` is used to find the last mount point via SYSTEM\MountedDevices.
* For Windows 7 and newer versions, additional locations such as Windows Portable Devices and VolumeInfoCache offer insights into device connections.
* MountedDevices contains mappings for drive letters to volume names, useful for identifying the last known drive letter assigned to a USB device.
* The VolumeInfoCache key may only reveal the last USB device mapped to a specific drive letter, without historical records.

### Overview

#### Drive Letter and Volume Name Association

The association between USB devices and their drive letters or volume names involves examining specific Registry keys that record these mappings. This process can help in identifying where a USB device was recognized in the system's file structure during its last connection.

#### Windows XP

In Windows XP, the process involves two steps:

1. **Identify the `ParentIdPrefix`**: Locate the device's `ParentIdPrefix` in `SYSTEM\CurrentControlSet\Enum\USBSTOR`.
2. **Discover the Last Mount Point**: Use the `ParentIdPrefix` to search in `SYSTEM\MountedDevices` for corresponding entries that indicate the last drive letter and volume name used by the device.

#### Windows 7 and Newer

For Windows 7 and newer versions, the analysis includes additional Registry keys:

* **Windows Portable Devices**: This key offers information on portable devices, including USB drives, connected to the system.
* **MountedDevices**: Similar to XP, this key provides mappings for drive letters to volume names. Analysts look for a serial number match within the value data to identify the drive letter used by a USB device.
* **VolumeInfoCache**: Offers details on the volume information of the last USB device mapped to a specific drive letter. Unlike MountedDevices, this key does not provide historical mapping records.

### Analyzing The Artifact

1. **For Windows XP**:
   * Retrieve the `ParentIdPrefix` from `USBSTOR`.
   * Search `SYSTEM\MountedDevices` using the `ParentIdPrefix` to find the device's last mount point.
2. **For Windows 7+**:
   * Inspect `SOFTWARE\Microsoft\Windows Portable Devices\Devices` for device entries.
   * Review `SYSTEM\MountedDevices` for drive letter mappings, looking for serial number matches.
   * Check `SOFTWARE\Microsoft\Windows Search\VolumeInfoCache` for the last drive letter associated with a USB device.

### Tools for Analysis

* **RegRipper**: Can automate the extraction of drive letter associations from the Registry.
* **Windows Registry Editor (`regedit`)**: Manually navigate the Registry to find the relevant keys and values.
* **Forensic Tools**: Tools like FTK or EnCase can search the Registry within a forensic image to find these artifacts.

### Practical Use Case

In an investigation involving unauthorized data transfer, identifying the drive letter and volume name associated with a USB device can help track the movement of files to and from the device. By correlating this information with file access logs and timestamps, forensic analysts can construct a timeline of events, potentially identifying malicious activity or policy violations.

This detailed approach to analyzing USB drive letter and volume name mappings in Windows systems provides forensic analysts with the capability to trace device connections and interactions, aiding in the reconstruction of digital events.