Volume serial number

The volume serial number (VSN) is an identifier written into a volume's boot sector when the volume is formatted. Windows displays it as two groups of four hexadecimal digits, for example in the output of vol or dir. On NTFS it is stored as an 8-byte value at offset 0x48 of the volume boot record, of which Windows shows the lower four bytes; FAT32 keeps a 4-byte value at offset 0x43.

The VSN belongs to the file system, not the hardware. Reformatting a USB stick gives it a new VSN, and it is unrelated to the device serial number that USB history records. It can also be changed deliberately, for example with Sysinternals VolumeID.

Its forensic value comes from the artifacts that record it. LNK files (and the shortcuts inside Jump Lists) store the VSN of the volume holding the target file, and Prefetch files record the serial numbers of the volumes an executable used. On systems where the ReadyBoost-related EMDMgmt key exists, its subkey names include the VSN of removable volumes, and the Microsoft-Windows-Partition/Diagnostic log can store raw boot-record bytes from which the VSN can be extracted.

Matching a VSN across these sources lets you tie a file opened from E:\ to a specific volume, and from there to a specific device in USB device history — the key step in proving that files were accessed from a particular removable drive.