Module mountpoints2 

Per-user volume mounts: decode MountPoints2 from a Windows NTUSER.DAT hive.

NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{GUID} records every volume the user mounted, keyed by the volume GUID. The subkey’s last-written time is the last time that user mounted the volume. This is per-user attribution — which user connected a device — that no machine-wide source provides; the volume GUID joins (via the MountedDevices MBR bridge) to a drive letter and its cached volume label.

Structs

UserMount

One per-user volume mount: the volume GUID and the last time the user mounted it.

Functions

parse_mountpoints2

Parse per-user MountPoints2 volume mounts from an already-opened NTUSER.DAT hive. Total over a valid hive: a non-{GUID} mount name (a UNC/##server#share entry) is skipped, never panicked on. file is recorded as each record’s Provenance file.