Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Another lesser known fact:

The volume id string (what you get with mountvol) is - at least up to Windows 10[1] a UUID version 1 according to RFC 4122, i.e. time and node based:

https://www.famkruithof.net/guid-uuid-make.html

https://www.famkruithof.net/guid-uuid-timebased.html

Since windows creates the UUID the first time it "sees" a volume, and - usually - uses the network card MAC as node, by decoding the UUID you can get the MAC address of the PC and the time the volume was seen (this can be useful for forensics, expecially with removable devices and to verify there has been no manipulation of the MountedDevices in the Registry).

[1]possibly windows 11 changed that, or at least the UUID's shown in the article are type 4



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: