mountvol.exe

  • File Path: C:\Windows\system32\mountvol.exe
  • Description: Mount Volume Utility

Hashes

Type Hash
MD5 F3EDFF85DE5FD002692D54A04BCB1C09
SHA1 4C844C5B0EE7CB230C9C28290D079143E00CB216
SHA256 CAF29650446DB3842E1C1E8E5E1BAFADAF90FC82C5C37B9E2C75A089B7476131
SHA384 6E5D0127C6BD7E1FF21B05674565031608275C42238A7C70CD794E5711AC76453525FF3201793E0B040585152E78BB40
SHA512 531D920E2567F58E8169AFC786637C1A0F7B9B5C27B27B5F0EDDBFC3E00CECD7BEA597E34061D836647C5F8C7757F2FE02952A9793344E21B39DDD4BF7985F9D
SSDEEP 384:abquDyuX3PMD1A77ciNqC/Elsrl+0+/QlDIINvB0WLFW:gquuuHPMDinDY9al+0WQFNvBZ
IMP 72D2CD1301A2466A3D1834DC3B95BE3F
PESHA1 B30703EA6D8390223B61552D3FBAE3C7BFE791D8
PE256 F130F3E4BBE0957960CC3442E09364645E73ABDB5B085DF9E34CBD4D20E567D9

Runtime Data

Usage (stdout):

Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L
MOUNTVOL [drive:]path /P
MOUNTVOL /R
MOUNTVOL /N
MOUNTVOL /E
MOUNTVOL drive: /S

    path        Specifies the existing NTFS directory where the mount
                point will reside.
    VolumeName  Specifies the volume name that is the target of the mount
                point.
    /D          Removes the volume mount point from the specified directory.
    /L          Lists the mounted volume name for the specified directory.
    /P          Removes the volume mount point from the specified directory,
                dismounts the volume, and makes the volume not mountable.
                You can make the volume mountable again by creating a volume
                mount point.
    /R          Removes volume mount point directories and registry settings
                for volumes that are no longer in the system.
    /N          Disables automatic mounting of new volumes.
    /E          Re-enables automatic mounting of new volumes.
    /S          Mount the EFI System Partition on the given drive.

Possible values for VolumeName along with current mount points are:

    \\?\Volume{38184124-336f-4bf7-bb7f-9d8459dba1b2}\
        C:\

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\mountvol.exe
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: MOUNTVOL.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

mountvol

Creates, deletes, or lists a volume mount point. You can also link volumes without requiring a drive letter.

Syntax

mountvol [<drive>:]<path volumename>
mountvol [<drive>:]<path> /d
mountvol [<drive>:]<path> /l
mountvol [<drive>:]<path> /p
mountvol /r
mountvol [/n|/e]
mountvol <drive>: /s

Parameters

Parameter Description
[<drive>:]<path> Specifies the existing NTFS directory where the mount point will reside.
<volumename> Specifies the volume name that is the target of the mount point. The volume name uses the following syntax, where GUID is a globally unique identifier: \\?\volume\{GUID}\. The brackets { } are required.
/d Removes the volume mount point from the specified folder.
/l Lists the mounted volume name for the specified folder.
/p Removes the volume mount point from the specified directory, dismounts the basic volume, and takes the basic volume offline, making it unmountable. If other processes are using the volume, mountvol closes any open handles before dismounting the volume.
/r Removes volume mount point directories and registry settings for volumes that are no longer in the system, preventing them from being automatically mounted and given their former volume mount point(s) when added back to the system.
/n Disables automatic mounting of new basic volumes. New volumes are not mounted automatically when added to the system.
/e Re-enables automatic mounting of new basic volumes.
/s Mounts the EFI system partition on the specified drive.
/? Displays help at the command prompt.

Remarks

  • If you dismount your volume while using the /p parameter, the volume list will show the volume as not mounted until a volume mount point is created.

  • If your volume has more than one mount point, use /d to remove the additional mount points before using /p. You can make the basic volume mountable again by assigning a volume mount point.

  • If you need to expand your volume space without reformatting or replacing a hard drive, you can add a mount path to another volume. The benefit of using one volume with several mount paths is that you can access all local volumes by using a single drive letter (such as C:). You don’t need to remember which volume corresponds to which drive letter—although you can still mount local volumes and assign them drive letters.

Examples

To create a mount point, type:

mountvol \sysmount \\?\volume\{2eca078d-5cbc-43d3-aff8-7e8511f60d0e}\

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.