Is anyone familiar with this notation for a drive letter in windows H:35\?
Resource Monitor in Windows 10 is showing me this syntax for a drive that has no drive letter but is mounted to a directory on my C drive. It is being shown under Disk Activity in Resource Monitor as:
H:35\somedir\blahblah
Of course trying to access it under this pathname give the error of invalid pathname. What is the meaning of H:35
?
This syntax is meaningless and has to do with some obscure Resource Monitor bug that dates back to Windows 7.
There have been multiple questions about this weird syntax, but no answers:
- What does D:2 mean as the drive in a Windows path?
- What does "C:0" in the path mean?
- Disk C:(OS) shows in the Resource monitor as E:2
- Weird file path bug? In Windows 10 Resource Monitor/Disk tab/Disk Activity/File column path does not display drive letter
- Resource Monitor shows disk activity on wrong disk
- リソースモニタのディスク活動でH:2¥の表示
This is the result of a bad find-and-replace. The bug can appear when there are at least 10 volumes known, regardless of how many are currently available or whether any are mounted in directories.
The "original" way Resource Monitor understands file paths involves Object Manager names, e.g. \Device\HarddiskVolume6\path\to\file.txt
. The device/volume part of these names is not so user-friendly, so Resource Monitor tries to translate the volume part to a "DOS device", i.e. drive letter with colon. Part of its initialization, specifically the WcdDiskMonitor__UpdateDrives
function in wdc.dll
, is building a table of Object Manager names and DOS devices using the GetLogicalDriveStrings
and QueryDosDevice
functions. On my computer right now, that table looks like this:
DOS device | Object Manager name |
---|---|
C: | \Device\HarddiskVolume6 |
E: | \Device\HarddiskVolume10 |
Lower numbers are occupied by various OEM partitions that don't have a drive letter. This will be important in a moment. Numbers 7 through 9 are unassigned because I created then deleted a few volumes.
WdcDiskMonitor__SetFileName
and WdcDiskMonitor__DeviceNameToDosName
prettify the file path as much as possible, which involves consulting the DOS devices table to replace an Object Manager name with a DOS device if possible. With just those DOS devices, disk activity on my E drive displays nicely because \Device\HarddiskVolume10
is identified as a volume with an assigned drive letter and replaced with E:
. Paths on the E drive don't start with \Device\HarddiskVolume6
, so C:
does not get substituted in.
But if I use e.g. mountvol
to assign a drive letter to volume 1, the DOS devices table looks like this:
DOS device | Object Manager name |
---|---|
R: | \Device\HarddiskVolume1 |
C: | \Device\HarddiskVolume6 |
E: | \Device\HarddiskVolume10 |
Resource Monitor now notices that e.g. \Device\HarddiskVolume10\numbers.txt
starts with the lettered \Device\HarddiskVolume1
and replaces just that string at the start with R:
, not considering the 0
, leaving R:0\numbers.txt
as the path for display:
To answer the question of how to determine the real meaning of this bogus drive specification, we can explore the Object Manager namespace with WinObj. Open the GLOBAL??
directory and find the entry whose name matches the drive letter (ignore the number after it for now), e.g. R:
. Note its Symbolic Link Target, e.g. \Device\HarddiskVolume1
. Append the extra number from Resource Monitor to that, reconstituting the Object Manager name, e.g. \Device\HarddiskVolume10
. Sort the list by Symbolic Link Target and find the names linked to this Object Manager name. If one of them is a drive letter, e.g. E:
, that's the volume Resource Monitor is talking about.
Otherwise, find the one whose name starts with Volume{
and cross-reference it with the output of mountvol
to find a more familiar-looking mount point.