Reading prefetch file content

Question

I'm using python prefetch view to read the prefetch files' content. But the tool show something like volume guid or anything instead of volume letter

Is there any correct way to convert "\VOLUME{01d820ac778f54ef-ba78425f}" to drive letter? Do it correctly and logically instead of trying to randomly replace characters like "C:" or "D:"

My guess i you can find this correspndence somewhere in the Windows registry. — Barmar
– Barmar, Commented Oct 23, 2023 at 17:13
What is "python prefetch view"? Please post your relevant code. — Barmar
– Barmar, Commented Oct 23, 2023 at 17:14

Karree · Accepted Answer · 2023-10-26 15:31:56Z

0

Lol, I have found the solution to solve my problem

It is using this code to get details of the volumes (driver serial and driver letter)

import wmi

c = wmi.WMI()
Drivers_Information = []
def to_hex(val, nbits):
  return hex((val + (1 << nbits)) % (1 << nbits)).lstrip('0x')

for i in c.Win32_Volume():
    Drivers_Information.append(("Driver_serial\\"+str(to_hex(i.SerialNumber,32)).replace("0x","")+"\\",i.Caption))

And compare with the volume serial number in the "volume information" then I know exactly which driver letter represented by the \VOLUME{01d820ac778f54ef-ba78425f}

If you have another better solution, pls let me know.

edited Oct 26, 2023 at 15:31

answered Oct 26, 2023 at 15:31

Karree

75 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Reading prefetch file content

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related