Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently experimenting with my own backup software, and just wondered where the NTFS volume GUID (i.e. the one that appears as \?\Volume{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}) is actually stored, offset wise, on the partition? Is it always at a calculatable offset, or is it part of the $MFT or $Volume record or something like that?

share|improve this question
Does this help: – Ryan Ries Oct 14 '13 at 22:56
Or this: – Matt Oct 15 '13 at 3:58
These both seem to refer to GPT style partition tables, my machine is currently using MBR. – PhilPotter1987 Oct 15 '13 at 19:28
Not sure if it helps, but I found it in every sector from 360 to 395 in a mounted vhd.The ordering of the hex values was significantly rearranged and the first octet was different from the value in MountedDevices in the registry. Try using a hex editor like HxD to search for the last portion of the guid as that appears verbatim. – sahmeepee Oct 15 '13 at 22:33
up vote 0 down vote accepted

I spent hours in front of a partition with my hex editor and discovered that the $VOLUME_NAME attribute of the $Volume metafile is actually just that - the textual volume name seen in 'Computer' and the likes - i.e. "My Disk"

It turns out that the GUID style I asked about above is stored only in the mount manager database within the registry at MountedDevices. What finally led me to this is that the same disk (with the same serial number on its NTFS partition) will get a different GUID if you plug it into a different machine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.