Module emdmgmt 

Volume label + serial history: decode EMDMgmt from a Windows SOFTWARE hive.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt is the ReadyBoost device cache. Windows evaluated every volume it saw for ReadyBoost and left one subkey per volume, named <device-prefix>__<VolumeLabel>_<VolumeSerialNumber> (the serial in decimal). It is a durable record of a removable volume’s label and 4-byte volume serial — the same serial a Shell Link’s DriveSerialNumber stores — so it ties a .lnk file-access to a named volume even after the device is gone. This reader emits those (label, volume_serial) facts.

Structs

EmdVolume

One cached volume: its label and 4-byte volume serial number.

Functions

parse_emdmgmt

Parse EMDMgmt volume records from an already-opened SOFTWARE hive. Total over a valid hive: a subkey whose name has no trailing _<decimal> serial is skipped, never panicked on. file is recorded as each record’s Provenance file.