Volume Serial Number

Description: Discover the Volume Serial Number of the File System Partition on the USB. (NOTE: This is not the USB Unique Serial Number, which is hard-coded into the device firmware.)

Location:

  • C:\Windows\System32\Config\SOFTWARE
    • SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ENDMgmt

Notes:

  • Use Volume Name and USB Unique Serial Number to:
    • Find the last Integer Number in Line.
    • Convert Decimal Serial Number into Hex Serial Number.
  • Knowing both the Volume Serial Number and the Volume Name, you can correlate the data across SHORTCUT File (.LNK) analysis and the RECENTDOCs key.
  • The Shortcut File (.LNK) contains the Volume Serial Number and Name.
  • RecentDocs Registry Key, in most cases, will contain the volume name when the USB device is opened via Explorer.

Analysis:
Coming Soon!