I recently visited a local computer system builder that I've worked with for more than 20 years. The owner (I'll refer to him as Bob) was assisting another consultant on a malware problem and assisting me with a disk warranty replacement. We had our usual friendly discussion, going back and forth across the bench. This time the chat was about disk identifiers. Bob said that you can't change the drive's serial number. I disagreed and mentioned that you can. Because there was no immediate need for further discussion on the subject, we just proceeded happily with our professional talk and the tasks at hand.
A couple weeks later I had a physical-to-physical project in which the disk identifier subject came up again. To complete the project, I had to review the technical aspects one more time. When I was doing some research on the Internet, I found that the terms disk signature, signature, disk ID, volume ID, file system label, drive serial number, volume serial number, and disk unique ID were used one way by some authors and other ways by other authors.
I therefore came up with my own mini-treatise on storage identifiers in NTFS. Here, I'll define these identifiers in terms of a single physical identifier and multiple logical identifiers. In this discussion, the term disk will mean any physical or logical storage container that holds either partitions or volumes, such as a hard disk, USB disk, solid state disk (SSD), Virtual Hard Disk (VHD), or Virtual Machine Disk (VMDK).
Single Physical Identifier
If Bob was referring to the manufacturer's serial number (as printed on the outside label of a disk) in our discussion about disk identifiers, he was absolutely correct. The manufacturer's serial number is an alphanumeric identifier that's burned into the drive's electronics and can't be changed (as far as I can determine). To see this number, you can look at the drive's exterior label or use a free Desktop Management Interface (DMI) software utility, such as Hiyohiyo's CrystalDMI, Belarc's Belarc Advisor, or Topala Software Solutions' System Information for Windows. Motherboard manufacturers such as HP and Toshiba also supply DMI utilities.
I propose that we refer to the physical identifier as the physical device serial number. To the best of my knowledge, it's used only for manufacturing, quality control, distribution, and warranty purposes.
Multiple Logical Identifiers
The logical identifier is what I was thinking about during my discussion with Bob. All logical identifiers can be changed under controlled conditions. The logical identifiers can be broken into two types: disk IDs and container IDs.
Disk IDs
Disk signature, signature, disk ID, drive serial number, UniqueID, and disk unique ID all refer to the same logical identifier that's stored in a disk's Master Boot Record (MBR). I propose that we refer to this identifier as the disk ID because that's how it's displayed by Windows' Diskpart utility.
The disk ID is located on the physical disk in Sector 0 (i.e., the 512-byte MBR) at offset 0x01B8. It's created by Windows (or another OS) when a new disk is seen by the OS for the first time. This is sometimes referred to as the "initialize" phase of provisioning a disk (not to be confused with the partitioning and formatting operations that follow initialization).
The disk ID in the MBR is a unique 4-byte identifier (i.e., an eight-digit alphanumeric identifier without spaces or dashes) that can't be changed by creating, deleting, or formatting partitions or volumes. In Windows Vista and later, you can use the Diskpart utility (which was introduced in Windows Server 2003 SP1) to find out the disk ID:
1. In a Command Prompt window, type diskpart and press Enter.
2. In the diskpart.exe window that appears, type list disk and press Enter. Write down the number of the disk for which you want to see the ID.
3. Type select disk #, where # is the number you wrote down in step 2. Press Enter.
4. Type detail disk and press Enter. The information that appears will include the disk ID. Alternatively, you can type uniqueid disk and press Enter to retrieve the disk ID.
5. Type exit and press Enter to end the Diskpart session.
Note that if you attach a new disk fresh out of the wrapper (or secure erase a used disk) and perform steps 1 through 4, the disk ID will be 00000000. The eight zeros tell you that the disk has never been initialized. If you then initialize the disk and repeat steps 1 through 4, you'll see that Windows created a unique alphanumeric disk ID, such as A1 B2 C3 D4. Interestingly, the disk ID will be laid out in the opposite direction -- D4 C3 B2 A1 -- on the physical disk. To avoid getting into a long discussion about endianness, I'll simply refer to this as being in "reverse sequence."
In Vista and later, you can also use the Microsoft Product Support Reports utility to see the disk ID. After you run the utility, find the dmdiag.log or diskmap.txt file in the General folder. The disk ID will be listed as the signature. Note that in the dmdiaglog file, the disk ID is prefixed with 0x.
In Windows XP, you can use the dmdiag.exe utility to see the disk ID. It will be listed as the signature in the "Partition Table Info Disk #" section.
According to a Microsoft Customer Service and Support (CSS) representative, Windows uses the disk ID as an index to store and retrieve information about the disk. For example, in the HKLM\SYSTEM\Mounted Devices registry subkey, the disk ID appears as REG_BINARY data in the \DosDevices\ <DriveLetter> and \\??\Volume{<xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>} entries because Windows uses the disk ID to store and retrieve information about persistent drive letter mappings and mount points.
In addition, the disk ID is used in RAID arrays (see technet.microsoft.com/en-us/library/cc771775.aspx) and Windows clustering (see support.microsoft.com/kb/883286/e). It's also used to enumerate physical disks in Vista and later. If you look in the Identifier entry under the HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\<WindowsDiskManagementDiskNumber> subkey, you'll see the disk ID embedded in the REG_SZ data.
The disk ID can be changed if necessary to support cloning situations (e.g., you want to reuse the old disk in the same storage system as the newly cloned disk). You can use the Diskpart utility to change the disk ID by following the instructions given previously. However, instead of typing disk detail or uniqueid disk in step 4, you'd type uniqueid disk id=xxxxxxxx, where xxxxxxxx is the new disk ID. Be aware that you can lose data or render your OS unbootable by tampering with the disk ID.
Container IDs
After a disk has been initialized, you can create partitions or volumes, which will also have identifiers. Before I discuss those identifiers, though, you need to know about some confusing terminology in the Microsoft Management Console (MMC) Disk Management snap-in (diskmgmt.msc).
If you create a partition on a disk, the disk is labeled as a "basic" disk in the Disk Management snap-in. According to the Help file for Windows 7's Disk Management snap-in, "Basic disks have been supported in operating systems since MS-DOS, while dynamic disks have been supported in operating systems since Windows 2000." Incidentally, converting a basic disk to a dynamic disk doesn't change its disk ID. For more information about basic and dynamic disks, read the article " Basic and Dynamic Disks." .Another dose of confusing terminology is introduced in Vista and later. If you're using XP's Disk Management snap-in to create a partition on a disk and you right-click somewhere in the space marked as Unallocated, you'll see the New Partition option. But if you're using Vista's or Windows 7's Disk Management snap-in, you'll see the New Simple/Spanned/Striped/Mirrored/RAID5 Volume option. Note the word Volume. Volumes aren't partitions. Rather, partitions on basic disks hold nondynamic volumes. With that said, if you choose "New Simple Volume," you'll actually get a basic disk with a partition. If you format that new partition, you'll create a nondynamic volume.
I'll hazard a guess that even though it's not technically correct, Microsoft chose to use the word volume instead of partition in the container creation process to shield users from the concept that partitions hold volumes. Perhaps Microsoft did so thinking that most users care only about creating volumes and don't care about the underlying partitions. But IT technicians should care about traditional partitions on basic disks because of the need to properly align partitions to maximize the performance of software such as Microsoft Exchange Server and SQL Server.
There are three types of container IDs: partition IDs, volume labels, and volume IDs. Note that converting a basic disk to a dynamic disk changes the partition IDs but doesn't change volume labels or volume IDs.
Partition IDs. A partition ID consists of four 16-byte entries in the disk's MBR. The information is located on the physical disk in Sector 0 at offset 0x01BE. Unlike disk IDs, partition IDs aren't assigned cryptic alphanumeric identifiers by Windows. If you use the Diskpart utility's detail partition command, you'll see that the first partition is identified as Partition 1, the second partition is identified as Partition 2, and so on. Interestingly, dmdiag.exe, dmdiag.log, and diskmap.txt identify the first partition as Partition0, the second partition as Partition1, and so on.
Volume labels. A volume label, which is also known as a file system label, is an optional alphanumeric identifier stored in the NTFS metafile $Volume. When you're formatting a disk, Windows suggests the name "New Volume," but you can customize it. After the volume is created, you can also change the volume label with no adverse effects. In XP and later, you can change it by right-clicking the disk, selecting Properties, and entering the new name (up to 32 alphanumeric characters) on the General tab. You can also change the Volume Label from a Command Prompt window by running a command such as
LABEL Q: IamDiskQ
Volume IDs. Volume identifier, VolumeID, and volume serial number all refer to the volume ID. A volume and its volume ID are created when you format a basic disk partition or create a dynamic disk volume. A volume ID is sometimes required for decoding content (see en.wikipedia.org/wiki/Advanced_Access_Content_System) and is thus employed as a weak form of copy protection. It's also used in Windows Activation in conjunction with the disk ID.
The Diskpart utility's list volume command enumerates all the volumes on a disk, identifying the first volume as Volume 0, the second volume as Volume 1, and so on. Although you can't see them in the list volume command's results, the volumes also have unique nine-character alphanumeric identifiers.
To see a volume ID in Windows OSs, you must first assign a drive letter to the disk using the Disk Management snap-in. (Right-click the volume, select Change Drive Letters and Paths, then choose Add.) Once that's done, there are several ways you can view the volume ID:
- In a Command Prompt window, type VOL and press Enter. It'll be listed as the Volume Serial Number and look like B633-B4C8, for example. Note the hyphen that Windows uses in the volume ID.
- Use a disk editor to view the logical disk. You'll find the volume ID in Sector 0 at offset 0x048 in reverse sequence compared with the way it's listed in the VOL command's results. In addition, there won't be a hyphen. So, for this example, it looks like C8 B4 33 B6.
- Use a disk editor to view the physical disk. You'll find the volume ID in Sector 63 at offset 0x7E48. Once again, it'll be in reverse sequence and without a hyphen (e.g., C8 B4 33 B6).
The Diskpart utility doesn't provide a way to change the volume ID. However, Mark Russinovich's free VolumeID utility provides this functionality for FAT and NTFS volumes. However, it's important to note that tampering with the volume ID can render your OS unbootable.
An End to the Confusion
I hope that this mini-treatise on storage identifiers has helped resolve any confusion you might have had about the terms signature, disk ID, volume ID, drive serial number, volume serial number, or disk unique ID. If you'd like to learn more about the systems and technologies behind these terms, check out the resources listed in the Learning Path.
LEARNING PATH
WINDOWS IT PRO RESOURCES
For background information about NTFS:
OTHER RESOURCES
For background information about NTFS:
NTFS File System Manages NTFS File System Metafiles
For more information about basic and dynamic disks:
Difference Between Basic and Dynamic Disks in Windows XP/2000/2003
For more information about MBRs:
Disk Editor View of the NFTS Boot Sector and Bootstrap Code
An Examination of the NTFS Volume Boot Record
An Examination of the Windows 7 MBR
Partition Types, Properties of Partition Tables, Section 2.8 Structure of the MBR – OS Additions
