Disk Partition Information in the Windows Registry "MountedDevices" Key
MountedDevices Registry Key (HKLM\SYSTEM\MountedDevices)
The MountedDevices key is a registry key that stores information about partitions that are currently mounted or were previously mounted on the system. It can be used to identify partitions that were assigned drive letters.
For previously mounted USB storage devices, HDDs, or SSDs, the corresponding storage device can be identified using a Disk Signature or Partition GUID. Residual information stored in the MountedDevices registry key can also be used to recover partitions that have been deleted from the partition table.
MountedDevices for MBR Partition Tables
[Figure] MountedDevices key value for a partition using the MBR partitioning scheme
For disks using the MBR partitioning scheme, the MountedDevices key value contains the disk's Disk Signature and the byte offset of the partition start location.
[Figure] "\DosDevices\C:" value in the MountedDevices key
| Offset |
Description |
| 0x00 ~ 0x03 |
MBR Disk Signature (4 bytes) |
| 0x04 ~ 0x0B |
Byte offset of the partition start relative to the beginning of the MBR disk (8 bytes, Little Endian) |
[Table] Structure of a MountedDevices key value for an MBR-partitioned disk
The MountedDevices key value contains the MBR Disk Signature, which can be used as information for identifying the disk from which the corresponding partition was mounted.
In addition, the MountedDevices key value for an MBR-partitioned disk contains the partition start offset. Therefore, this information can be used to locate and recover partitions whose entries have been deleted from the partition table.
[Figure] Disk Signature identified in the MBR
[Figure] Starting sector of the \DosDevices\C: partition (Sector 2,048)
By examining the \DosDevices\C: value in MountedDevices, the MBR Disk Signature can be identified as 7A 1B 06 00. The partition start sector is calculated as 2,048 sectors (0x100000 / 0x200).
Starting sector of \DosDevices\C:
0x100000 / 0x200 (sector size) = 0x800 (2,048) sectors
The Partition Start Byte Offset is a byte-based offset measured from sector 0 of the physical disk, where the MBR is located. Therefore, to convert this value into a sector number, the partition start offset stored in the MountedDevices key must be divided by the sector size.
Recovering Deleted MBR Partitions Using MountedDevices Values
The partition recovery example described in this section was performed on a forensic image from the "9th Digital Criminal Investigation Competition."
In the image, the C: drive containing the Windows operating system had not been deleted. Therefore, the SYSTEM hive (C:\Windows\System32\config\SYSTEM) could be extracted from the C: drive, and the MountedDevices key could be examined to recover the remaining deleted partitions.
[Figure] Two partition entries remaining in the MBR partition table at sector 0 of the forensic image
[Figure] Two partitions normally recognized by FTK Imager from the remaining MBR partition table entries
The MBR partition table contained only two partition entries. When the image was examined using FTK Imager, only those two partitions were recognized normally.
[Figure] MountedDevices key
By examining the MountedDevices key, three additional partitions that had been assigned drive letters were identified as originating from the same disk as the C: drive. This indicates that a total of four partitions had previously been mounted from the disk with the Disk Signature 7A 1B 06 00.
| Drive Letter |
Starting Sector |
| C: |
2,048 |
| D: |
120,162,256 |
| E: |
116,068,352 |
| F: |
114,018,304 |
[Table] Partition information with the same Disk Signature identified from the MountedDevices key
The C: and F: partitions were found at starting sectors corresponding to entries that still existed in the MBR partition table and could therefore be recognized normally by FTK Imager.
In contrast, the D: and E: partitions were not recorded in the MBR partition table and could not be recognized normally. These partitions were therefore identified as deleted partitions.
[Figure] Starting sector of the D: partition identified from the MountedDevices key
[Figure] Starting sector of the E: partition identified from the MountedDevices key
The start-sector locations of the D: and E: partitions were identified from the MountedDevices key. The corresponding locations were then examined, and the total number of sectors for each partition was obtained from the VBR.
The partition regions were extracted from each partition start sector using the total number of sectors recorded in the VBR. Through this process, the deleted D: and E: partition areas were recovered, allowing the internal structures of both partitions to be examined normally.
In this case, the MountedDevices entries contained the same Disk Signature, allowing the corresponding partitions to be inferred as partitions from the same MBR disk.
If MountedDevices entries with different Disk Signature values are present, the corresponding partitions may have originated from different physical disks, such as an external hard drive or an additional internal disk.
GPT MountedDevices
Unlike MBR partitions, GPT partitions have a unique GUID for each partition. Therefore, for disks using the GPT partitioning scheme, the MountedDevices key contains the corresponding Partition GUID.
[Figure] MountedDevices key value for a partition using the GPT partitioning scheme
[Figure] Matching C: partition GUID identified in both the GPT partition table and the MountedDevices key
| Offset |
Description |
| 0x00 ~ 0x07 |
ASCII string "DMIO:ID:" (8 bytes) |
| 0x08 ~ 0x17 |
Unique Partition GUID (16 bytes) |
[Table] Structure of a MountedDevices key value for a GPT-partitioned disk
Unlike the MBR format, the GPT-format MountedDevices value does not contain information about the partition start location, such as a partition start sector offset. It contains only the Partition GUID.
Therefore, additional information from the GPT partition table must be examined to determine the starting sector of the partition.