A Mini-Treatise on Storage Device Identifiers in NTFS

 I recently visited a local computer system builder that I've worked with for more than 20 years. The owner (I'll refer to him as Bob) was assistinganother consultant on a malware problem and assisting me with a disk warranty replacement. We had our usual friendly discussion, going back and forthacross the bench. This time the chat was about disk identifiers. Bob said that you can't change the drive's serial number. I disagreed and mentionedthat you can. Because there was no immediate need for further discussion on the subject, we just proceeded happily with our professional talk and thetasks at hand.

A couple weeks later I had a physical-to-physical project in which the disk identifier subject came up again. To complete the project, I had to reviewthe technical aspects one more time. When I was doing some research on the Internet, I found that the termsdisk signature, signature, disk ID, volume ID, file system label, drive serial number, volume serial number, and disk unique ID wereused one way by some authors and other ways by other authors.

I therefore came up with my own mini-treatise on storage identifiers in NTFS. Here, I'll define these identifiers in terms of a single physicalidentifier and multiple logical identifiers. In this discussion, the term disk will mean any physical or logical storage container that holds eitherpartitions or volumes, such as a hard disk, USB disk, solid state disk (SSD), Virtual Hard Disk (VHD), or Virtual Machine Disk (VMDK).

Single Physical Identifier

If Bob was referring to the manufacturer's serial number (as printed on the outside label of a disk) in our discussion about disk identifiers, he wasabsolutely correct. The manufacturer's serial number is an alphanumeric identifier that's burned into the drive's electronics and can't be changed (asfar as I can determine). To see this number, you can look at the drive's exterior label or use a free Desktop Management Interface (DMI) softwareutility, such as Hiyohiyo's CrystalDMI, Belarc's Belarc Advisor, orTopala Software Solutions' System Information for Windows. Motherboard manufacturers such as HP and Toshiba also supply DMI utilities.

I propose that we refer to the physical identifier as the physical device serial number. To the best of my knowledge, it's used only formanufacturing, quality control, distribution, and warranty purposes.

Multiple Logical Identifiers

The logical identifier is what I was thinking about during my discussion with Bob. All logical identifiers can be changed under controlled conditions.The logical identifiers can be broken into two types: disk IDs and container IDs.

Disk IDs

Disk signature, signature, disk ID, drive serial number, UniqueID,and disk unique ID all refer to the same logical identifier that's stored in a disk's Master Boot Record (MBR). I propose that we refer tothis identifier as the disk ID because that's how it's displayed by Windows' Diskpart utility.

The disk ID is located on the physical disk in Sector 0 (i.e., the 512-byte MBR) at offset 0x01B8. It's created by Windows (or another OS) when a newdisk is seen by the OS for the first time. This is sometimes referred to as the "initialize" phase of provisioning a disk (not to be confused with thepartitioning and formatting operations that follow initialization).

The disk ID in the MBR is a unique 4-byte identifier (i.e., an eight-digit alphanumeric identifier without spaces or dashes) that can't be changed bycreating, deleting, or formatting partitions or volumes. In Windows Vista and later, you can use the Diskpart utility (which was introduced in WindowsServer 2003 SP1) to find out the disk ID:

1. In a Command Prompt window, type diskpart and press Enter.

2. In the diskpart.exe window that appears, type list disk and press Enter. Write down the number of the disk for which you want to see theID.

3. Type select disk #, where # is the number you wrote down in step 2. Press Enter.

4. Type detail disk and press Enter. The information that appears will include the disk ID. Alternatively, you can typeuniqueid disk and press Enter to retrieve the disk ID.

5. Type exit and press Enter to end the Diskpart session.

Note that if you attach a new disk fresh out of the wrapper (or secure erase a used disk) and perform steps 1 through 4, the disk ID will be 00000000.The eight zeros tell you that the disk has never been initialized. If you then initialize the disk and repeat steps 1 through 4, you'll see thatWindows created a unique alphanumeric disk ID, such as A1 B2 C3 D4. Interestingly, the disk ID will be laid out in the opposite direction -- D4 C3 B2A1 -- on the physical disk. To avoid getting into a long discussion about endianness, I'll simply refer to this as being in "reverse sequence."

In Vista and later, you can also use the Microsoft Product Support Reports utility  to see thedisk ID. After you run the utility, find the dmdiag.log or diskmap.txt file in the General folder. The disk ID will be listed as the signature. Notethat in the dmdiaglog file, the disk ID is prefixed with 0x.

In Windows XP, you can use the dmdiag.exe utility to see the disk ID. It will be listed as the signature in the "Partition Table Info Disk #" section.

According to a Microsoft Customer Service and Support (CSS) representative, Windows uses the disk ID as an index to store and retrieve informationabout the disk. For example, in the HKLMSYSTEMMounted Devices registry subkey, the disk ID appears as REG_BINARY data in the DosDevices and \??Volume{} entries because Windows uses the disk ID to store andretrieve information about persistent drive letter mappings and mount points.

In addition, the disk ID is used in RAID arrays (see technet.microsoft.com/en-us/library/cc771775.aspx) and Windows clustering (seesupport.microsoft.com/kb/883286/e). It's also used to enumerate physical disks in Vista and later. If you look in the Identifier entry under theHKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapterDiskControllerDiskPeripheral subkey, you'llsee the disk ID embedded in the REG_SZ data.

The disk ID can be changed if necessary to support cloning situations (e.g., you want to reuse the old disk in the same storage system as the newlycloned disk). You can use the Diskpart utility to change the disk ID by following the instructions given previously. However, instead of typingdisk detail or uniqueid disk in step 4, you'd type uniqueid disk id=xxxxxxxx, where xxxxxxxx isthe new disk ID. Be aware that you can lose data or render your OS unbootable by tampering with the disk ID.

Container IDs

After a disk has been initialized, you can create partitions or volumes, which will also have identifiers. Before I discuss those identifiers, though,you need to know about some confusing terminology in the Microsoft Management Console (MMC) Disk Management snap-in (diskmgmt.msc).

If you create a partition on a disk, the disk is labeled as a "basic" disk in the Disk Management snap-in. According to the Help file for Windows 7'sDisk Management snap-in, "Basic disks have been supported in operating systems since MS-DOS, while dynamic disks have been supported in operatingsystems since Windows 2000." Incidentally, converting a basic disk to a dynamic disk doesn't change its disk ID. For more information about basic anddynamic disks, read the article "Basic and Dynamic Disks." .

Another dose of confusing terminology is introduced in Vista and later. If you're using XP's Disk Management snap-in to create a partition on a diskand you right-click somewhere in the space marked as Unallocated, you'll see the New Partition option. But if you're using Vista's or Windows 7's DiskManagement snap-in, you'll see the New Simple/Spanned/Striped/Mirrored/RAID5 Volume option. Note the word Volume. Volumes aren't partitions.Rather, partitions on basic disks hold nondynamic volumes. With that said, if you choose "New Simple Volume," you'll actually get a basic disk with apartition. If you format that new partition, you'll create a nondynamic volume.

I'll hazard a guess that even though it's not technically correct, Microsoft chose to use the word volume instead of partition in thecontainer creation process to shield users from the concept that partitions hold volumes. Perhaps Microsoft did so thinking that most users care onlyabout creating volumes and don't care about the underlying partitions. But IT technicians should care about traditional partitions on basic disksbecause of the need to properly align partitions to maximize the performance of software such as Microsoft Exchange Server and SQL Server.

There are three types of container IDs: partition IDs, volume labels, and volume IDs. Note that converting a basic disk to a dynamic disk changes thepartition IDs but doesn't change volume labels or volume IDs.

Partition IDs.A partition ID consists of four 16-byte entries in the disk's MBR. The information is located on the physical disk in Sector 0 at offset 0x01BE. Unlikedisk IDs, partition IDs aren't assigned cryptic alphanumeric identifiers by Windows. If you use the Diskpart utility's detail partitioncommand, you'll see that the first partition is identified as Partition 1, the second partition is identified as Partition 2, and so on. Interestingly,dmdiag.exe, dmdiag.log, and diskmap.txt identify the first partition as Partition0, the second partition as Partition1, and so on.

Volume labels.A volume label, which is also known as a file system label, is an optional alphanumeric identifier stored in the NTFS metafile $Volume. When you'reformatting a disk, Windows suggests the name "New Volume," but you can customize it. After the volume is created, you can also change the volume labelwith no adverse effects. In XP and later, you can change it by right-clicking the disk, selecting Properties, and entering the new name (up to 32alphanumeric characters) on the General tab. You can also change the Volume Label from a Command Prompt window by running a command such as

LABEL Q: IamDiskQ 

Volume IDs. Volume identifier, VolumeID, and volume serial number all refer to the volume ID. A volume and its volume ID are created when you format a basic diskpartition or create a dynamic disk volume. A volume ID is sometimes required for decoding content (seeen.wikipedia.org/wiki/Advanced_Access_Content_System) and is thus employed as a weak form of copy protection. It's also used in Windows Activation inconjunction with the disk ID.

The Diskpart utility's list volume command enumerates all the volumes on a disk, identifying the first volume as Volume 0, the second volumeas Volume 1, and so on. Although you can't see them in the list volume command's results, the volumes also have unique nine-characteralphanumeric identifiers.

To see a volume ID in Windows OSs, you must first assign a drive letter to the disk using the Disk Management snap-in. (Right-click the volume, selectChange Drive Letters and Paths, then choose Add.) Once that's done, there are several ways you can view the volume ID:

The Diskpart utility doesn't provide a way to change the volume ID. However, Mark Russinovich's free VolumeID utility  provides this functionality for FAT and NTFS volumes. However, it's important to note thattampering with the volume ID can render your OS unbootable.

An End to the Confusion

I hope that this mini-treatise on storage identifiers has helped resolve any confusion you might have had about the termssignature, disk ID, volume ID, drive serial number, volume serial number, or disk unique ID. If you'd like to learn more about thesystems and technologies behind these terms, check out the resources listed in the Learning Path.

LEARNING PATH

WINDOWS IT PRO RESOURCES

For background information about NTFS:

“Inside NTFS”

OTHER RESOURCES

For background information about NTFS:

How NTFS Works

NTFS File System Manages NTFS File System Metafiles

NTFS Metafiles

For more information about basic and dynamic disks:

Basic and Dynamic Disks

Difference Between Basic and Dynamic Disks in Windows XP/2000/2003

Dynamic Disks and Volumes

For more information about MBRs:

Disk Editor View of the NFTS Boot Sector and Bootstrap Code

An Examination of the NTFS Volume Boot Record

An Examination of the Windows 7 MBR

Master Boot Record

Partition Types, Properties of Partition Tables, Section 2.8 Structure of the MBR – OS Additions