Mysterious mount points (volumes) jumping between drives

Hi,

I enquiring about "mount points." While looking into my System Protection / Restore Points settings (C:\Windows\System32\SystemPropertiesProtection.exe, which can also be accessed through the Control Panel), I found a volume that was somehow linked to my C:\ drive. It had no drive letter and a very strange name: \\?\Volume{59e11a40-8cbe-4b4b-b8bd-19c1ee534165}\

After a lot of trial and error (searching for the volume GUID in the registry), I found out that this bizarre volume had exactly the same size as the fifth partition (the recovery partition) on my C:\ drive, and that the enigmatic volume was a mount point.. Its existence was apparently linked to the creation of a boot menu entry (Windows PE) with Hasleo Backup Suite.

So far, so good.

My curiosity was piqued, however, and I searched a bit further on the web about mount points. I had seen from my registry search that there were other mount points on my system. I was looking for a way to find all mount points on my computer and find out what they were doing or why they were there. I came across this link, which explains how to do that with the following command in PowerShell (as admin):


By doing this, I found another mount point volume linked to drive G:\ of my system:



My drives G and F are on an external USB drive, while my other drives are internal. Searching for the reason this second enigmatic volume existed, I didn’t find anything. So, I decided to try to delete this mount point. Online documentation explains that one must use commands that require knowing the path of the drive from where the volume has been mounted.

However, I don’t know what created this mount point volume, and I couldn't find any indication of it in the registry.

So, I finally chose a radical approach: I deleted everything on drive G:\ (after backing up the content elsewhere) and formatted it. Then, I searched again for the mount points on my PC using the PowerShell command above... and the volume was still there. Next, I deleted volume G:\ completely (leaving it as unallocated space) and extended volume F:\ so that G:\ no longer existed. Guess what... The strange volume was still there, and was now linked to volume F:\.

Finally, I also deleted volume F:\ (it’s only my secondary backup volume; I still have the primary backup and can copy the data back over later).

And now the whole thing gets completely crazy! The strange volume was now linked to volume E:\, which is on another disk (!).

What on earth is going on here? And how can I find out what created that mount point (volume)?

Thanks for any help!

Frankly if you're not having a problem I wouldn't be messing with volumes. Volumes can exist that don't show up in disk management such as Google Drive or OneDrive.

Do you game? The Xbox app creates virtual drives/volumes for games

BrianInEngland said:

Do you game? The Xbox app creates virtual drives/volumes for games

Click to expand...

No, I am old school, I do not game at all and I have completely uninstalled OneDrive !

---

@neemobeer

Thanks! Are you saying that there are things that are happening (in the background on the NTFS file system) on my computer, that I cannot (or should better) not try to control ?

There's nothing mysterious. Some volumes correspond to the EFI or Recovery volumes.

Which can be seen here as well, among other areas.

garlin said:

There's nothing mysterious. Some volumes correspond to the EFI or Recovery volumes

Click to expand...

Thank you !

I run your commands, but the volume linked to drive G:\ (see screenshot in my first contribution) is shown nowhere.




EDIT: Sorry, it is there: The GUID (beginning with e6cfe128) is the one of the FAT 32 partition on Drive C:\. But as one can see in the first screenshot (first contribution) this mount point is linked to drive G:\.

So what drive G:\has to do with the FAT partitipon on drive C:\ ?

Every drive volume has an UniqueID (which is a hashed value). Whenever possible, most Windows tools or commands will display a drive letter if one is assigned to the volume, instead of printing the UniqueID. Humans find drive letters easier to read.

Get-WmiObject Win32_Volume prints a list of drive volumes, with one entry per line.

There is no "special" volume assigned to G: on the next line, it's simply a different volume which happens to appear next in the sorted list. Just like C: does not have a special volume because the Recovery volume happens to be listed next.

You are assuming the two lines with UniqueID are each linked to the line that appears before them. They are not related in any way.

OAT said:

Which can be seen here as well, among other areas.

View attachment 176090

Click to expand...

Thank you that helped !
I have now identified my three volumes, which have no drive letter:


The first one is the mount point volume of the Hasleo Boot menu (Drive C:\)
The second one is my CD Drive
The third one is the FAT 32 partition on drive C:\.

This still leaves the question why my G:\ drive is linked to the FAT 32 partition on drive C:\ (or vice versa)

Thanks to everyone !

garlin said:

You are assuming the two lines with UniqueID are each linked to the line that appears before them. They are not related in any way.

Click to expand...

Thank you very much, ... that gives the answer to the last question I had !