1

I'm trying to determine, how Windows creates the GUID for a given disk volume. What are the various components / sections of a given volume GUID, and what is each section referring too, in a typical hyphen separated volume GUID like this: 26a21bda-a627-11d7-9931-806e6f6e6963

Secondarily, and the reason I'm trying to determine this, is to figure out why so often, the C:\ volume GUID ends in "6963" on many Windows installs. Since GUID's are intended to be largely unique, I'm assuming something with how these GUID's are created, so very often leads to the C:\ GUID ending in 6963? Which seems like a fairly random number to end with - yet if you google 6963 GUID you'll see how very common it is indeed! I work with disk images of servers at my job and see the volume GUID's for hundreds of servers per week, and the fact that they're so often ending in 6963 has had me curious far too often.

In fact, multiple of Microsoft's own articles, like this one, contain GUID ending in 6963: https://docs.microsoft.com/en-us/windows/desktop/fileio/naming-a-volume

I have been searching around, and have found very little in the way of an explanation as to how these GUID's are created for disk volumes specifically, and/or why 6963 is so often the ending string, especially for C:\ partitions.

Thank you in advance!

Protonus
  • 11

1 Answers1

3

According to Wikipedia Universally unique identifier, the UUID ends with a "48-bit node id".

RFC 4122 defines the node id as:

4.1.6. Node

For UUID version 1, the node field consists of an IEEE 802 MAC address, usually the host address. For systems with multiple IEEE 802 addresses, any available one can be used. The lowest addressed octet (octet number 10) contains the global/local bit and the unicast/multicast bit, and is the first octet of the address transmitted on an 802.3 LAN.

For systems with no IEEE address, a randomly or pseudo-randomly generated value may be used; see Section 4.5. The multicast bit must be set in such addresses, in order that they will never conflict with addresses obtained from network cards.

For UUID version 3 or 5, the node field is a 48-bit value constructed from a name as described in Section 4.3.

For UUID version 4, the node field is a randomly or pseudo-randomly generated 48-bit value as described in Section 4.4.

The UUID version is stored in the first byte of the UUID. Once you know the version number, you can have a look at the matching algorithm.

But in the end, some parts will remain obscure.

The article GUIDs are globally unique, but substrings of GUIDs aren’t adds some more information, adding that the UUID terminates by:

six bits are fixed

There is no specification given of what they are fixed, but it seems from the Wikipedia article that they have to do with further identifying the type of the UUID, raising the likelihood that the last bytes will be recurring. These bytes will certainly be identical for all UUIDs generated on the same computer if they are of the same type.

I think that the above just about summarizes all that is known about UUIDs in Windows.

harrymc
  • 498,455