Share via

Where in registry are the paths of mounted volumes stored?

Question

Wednesday, March 9, 2016 4:17 AM | 2 votes

In Disk Management we can assign drive letters and/or paths to a volume to get it mounted. While the drive letters mapping are recorded in HKLM\System\MountedDevices, where are the paths stored in the registry?

All replies (11)

Thursday, March 10, 2016 3:52 PM | 3 votes

Hi, 

Do you mean the network location? 

If so, it is saved under this registry key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\Network location"

HKEY_CURRENT_USER \Network\Z

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].

Thursday, March 10, 2016 7:43 PM | 1 vote

In Disk Management we can assign drive letters and/or paths to a volume to get it mounted. While the drive letters mapping are recorded in HKLM\System\MountedDevices, where are the paths stored in the registry?

Do you mean the GUIDs returned by mountvol?

Anyway, please read this article:

http://www.forensicmag.com/articles/2012/06/windows-7-registry-forensics-part-5

Well this is the world we live in And these are the hands we're given...

Friday, March 11, 2016 7:09 AM | 1 vote

No, I mean this:

Friday, March 11, 2016 9:55 AM | 2 votes

Hi, 

That could be in this registry key: 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\LOCALMOF\

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].

Friday, March 11, 2016 5:38 PM | 1 vote

I don't think so. I don't see that the paths are mapped to any GUID or so.

Wednesday, March 16, 2016 10:03 AM | 1 vote

Hi, 

That's what i captured by process monitor during reproducing this process. 

You can also try yourself to find what you want: 

Process Monitor v3.05
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx 

Using Process Monitor to capture system events
http://www.sophos.com/en-us/support/knowledgebase/119038.aspx 

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].

Wednesday, March 16, 2016 10:47 AM | 1 vote

Hi tom,

Look at this URL's: 

I hope this will helpful to you. Thanks in advance.

Regards,

Arun

Wednesday, March 16, 2016 11:27 AM | 1 vote

I don't think so. I don't see that the paths are mapped to any GUID or so.

The path referred to by Kate was slightly incorrect on its end. The correct path would be:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\<VOLUME_GUID>

Where <VOLUME_GUID> is the ID of the mounted volume, for example.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{634ca3a3-1276-11e5-b4a7-b9e109d95c6e}

And here's the output of the Mounvol that confirms the registry key referred is correct and is linked to the mounted volume:

    \\?\Volume{634ca3a3-1276-11e5-b4a7-b9e109d95c6e}\
        F:\
        D:\Mount\

Here F:\ is a USB stick and D:\Mount is the folder on a local D:\ drive were the F:\ volume is mounted to.

Well this is the world we live in And these are the hands we're given...

Sunday, March 20, 2016 9:58 AM

So this is my test case with an external drive (`E:`):

If I shut down the computer, and restart it without the drive connected:

As you can see, the entry under `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\ already disappeared (i.e. it's "volatile"). Also, an extra entry popped out under `HKLM\SYSTEM\MountedDevices`.

The entry under `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\LocalMOF\ remains though:

Then I deleted all the entries related to `E:`:

Once I reboot, the extra entry popped out under `HKLM\SYSTEM\MountedDevices` comes back:

But not the one under LocalMOF though:

Then I connect the drive again. The path mapping is NOT removed (as hinted by the extra entry popped out under `HKLM\SYSTEM\MountedDevice`):

As you can notice I restarted regedit. The entry in LocalMOF does not come back right after I connect the drive again. In fact, it will only come back if I boot Windows with the drive connected.

So far the only way I discovered to remove the path mappings (I mean except `Disk Management`) is `mountvol /R`, unlike drive letters mapping, which you can delete directly from `HKLM\SYSTEM\MountedDevices`. However, I notice that `mountvol /R` does not even remove entries under `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\LocalMOF\.

Friday, October 6, 2017 1:34 PM

I think the paths are actually junctions/reparse points, and as such are stored in the file system. If you mount a drive to a folder, a junction is created at that location (use dir /L to see the junction).

At the same time the LocalMOF entries are created so diskmgmt and MountVol know what mount points have been created. As you found, these entries do not affect access to the mount folder whenever the drive is connected, because the junction still exists at the mount folder in the file system even if those registry entries are deleted.

However, if you delete the junction, the mount point is removed from diskmgmt and mountvol.

Probably why you can only mount drives into NTFS sub-folders (maybe ExFAT too, but I don't use it).

I had a bunch of mount points for USB drives under T:\DriveMounts (so I have fixed locations with not enough drive letters), and just realized that some were created by direct junction creation instead of using diskmgmt or mountvol. I found out by accidentally running mountvol /r instead of mountvol /l, and many of my mount folders were deleted (those created by diskmgmt/mountvol), but some remained because they were created directly as junctions, so no LocalMOF registry entry and mountvol wasn't aware of them. Now I just have to recreate them. :(

Thursday, December 19, 2019 12:03 AM

In Disk Management we can assign drive letters and/or paths to a volume to get it mounted. While the drive letters mapping are recorded in HKLM\System\MountedDevices, where are the paths stored in the registry?

Volumes mounted as a folder are not stored in the registry. They are actually NTFS Junctions stored in the filesystem itself. For example, i used Disk Management to mount a drive as:

    E:\Expansion



You can then see the NTFS junction from the command-line:

    D:\dir /al
     Volume in drive D is Develop
     Volume Serial Number is 1E62-DDA3
    
     Directory of D:\
    
    12/18/2019  06∶47 ᴘᴍ    <JUNCTION>     Expansion [\?\Volume{b3eb1921-0000-0000-0000-100000000000}\