mountvol.exe

  • File Path: C:\Windows\SysWOW64\mountvol.exe
  • Description: Mount Volume Utility

Hashes

Type Hash
MD5 E0B3FFF7584298E77DFFB50796839FED
SHA1 4934F95BA483F3626E91C7B16DA609DDF04E8081
SHA256 F247BE88F22B07A36F4B71707ED7A96BD989BAD37A7500DA03B81709749DED7E
SHA384 7C2259B742D8C889B8355876EF4E792C9CF54688776CB966FCA94CE7232E27AC245F0FF23AC50868B8AC150529CE41A9
SHA512 49F56C904C8E8433F13D49D6F2C67BECFB1FC8CA41C28ABBD67687FFBA00095827F2000F39F1DB217A1EF47FF9EF6FCC8B150572F4DD9B779565932EB4C7A709
SSDEEP 384:Ob5fptnL+WMPDmOK84xVLdI8NuIcWLFWq:ofr+WMPDMx31NuIB
IMP 30F2C65A9103A7536B77118A741917B8
PESHA1 75141692C6580AD5F9890E32530BD94BA5E05F8C
PE256 809333394E05CB5ABF942D826E545483638655624AD6FF8452EDEB24A9D9C500

Runtime Data

Usage (stdout):

Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L
MOUNTVOL [drive:]path /P
MOUNTVOL /R
MOUNTVOL /N
MOUNTVOL /E
MOUNTVOL drive: /S

    path        Specifies the existing NTFS directory where the mount
                point will reside.
    VolumeName  Specifies the volume name that is the target of the mount
                point.
    /D          Removes the volume mount point from the specified directory.
    /L          Lists the mounted volume name for the specified directory.
    /P          Removes the volume mount point from the specified directory,
                dismounts the volume, and makes the volume not mountable.
                You can make the volume mountable again by creating a volume
                mount point.
    /R          Removes volume mount point directories and registry settings
                for volumes that are no longer in the system.
    /N          Disables automatic mounting of new volumes.
    /E          Re-enables automatic mounting of new volumes.
    /S          Mount the EFI System Partition on the given drive.

Possible values for VolumeName along with current mount points are:

    \\?\Volume{38184124-336f-4bf7-bb7f-9d8459dba1b2}\
        C:\

Child Processes:

explorer.exe

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\mountvol.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: MOUNTVOL.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/f247be88f22b07a36f4b71707ed7a96bd989bad37a7500da03b81709749ded7e/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

mountvol

Creates, deletes, or lists a volume mount point. You can also link volumes without requiring a drive letter.

Syntax

mountvol [<drive>:]<path volumename>
mountvol [<drive>:]<path> /d
mountvol [<drive>:]<path> /l
mountvol [<drive>:]<path> /p
mountvol /r
mountvol [/n|/e]
mountvol <drive>: /s

Parameters

Parameter Description
[<drive>:]<path> Specifies the existing NTFS directory where the mount point will reside.
<volumename> Specifies the volume name that is the target of the mount point. The volume name uses the following syntax, where GUID is a globally unique identifier: \\?\volume\{GUID}\. The brackets { } are required.
/d Removes the volume mount point from the specified folder.
/l Lists the mounted volume name for the specified folder.
/p Removes the volume mount point from the specified directory, dismounts the basic volume, and takes the basic volume offline, making it unmountable. If other processes are using the volume, mountvol closes any open handles before dismounting the volume.
/r Removes volume mount point directories and registry settings for volumes that are no longer in the system, preventing them from being automatically mounted and given their former volume mount point(s) when added back to the system.
/n Disables automatic mounting of new basic volumes. New volumes are not mounted automatically when added to the system.
/e Re-enables automatic mounting of new basic volumes.
/s Mounts the EFI system partition on the specified drive.
/? Displays help at the command prompt.

Remarks

  • If you dismount your volume while using the /p parameter, the volume list will show the volume as not mounted until a volume mount point is created.

  • If your volume has more than one mount point, use /d to remove the additional mount points before using /p. You can make the basic volume mountable again by assigning a volume mount point.

  • If you need to expand your volume space without reformatting or replacing a hard drive, you can add a mount path to another volume. The benefit of using one volume with several mount paths is that you can access all local volumes by using a single drive letter (such as C:). You don’t need to remember which volume corresponds to which drive letter—although you can still mount local volumes and assign them drive letters.

Examples

To create a mount point, type:

mountvol \sysmount \\?\volume\{2eca078d-5cbc-43d3-aff8-7e8511f60d0e}\

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.