"The MountedDevices subkey stores the database of mounted devices for the NTFS file system. This database associates persistent volume names with unique internal indentifiers for volumes. The internal identifiers often include the disk signatures of the volumes. This pairing enables NTFS to maintain the identity and persistent name of a volume, even when its variable device name changes." - Microsoft
Registry Analysis (Windows Forensic Analysis) Part 6 - what when how
Mounted Devices - Microsoft
Registry , USB
Get exclusive access to online courses and content through Patreon !