Module volume_info 

Volume-label source: decode VolumeInfoCache from a Windows SOFTWARE hive.

SOFTWARE\Microsoft\Windows Search\VolumeInfoCache\<X:> caches, per mounted volume, the drive letter it was seen at and its volume label. For a removable device this is the human-readable name the user gave the stick (“Authorized USB”, “IAMAN”), which corroborates the device that mounted that drive letter. This reader emits those (drive_letter, volume_label) facts; the correlation layer joins them to a device via the drive letter (MountedDevices).

Structs

VolumeLabel

A cached volume label keyed by the drive letter it was mounted at.

Functions

parse_volume_info_cache

Parse VolumeInfoCache volume labels from an already-opened SOFTWARE hive.