Want to see the contents of the system partition on Windows 7?

On Windows 7 the system partition, the partition the computer boots from (I know, I know, the names are messed up.), is hidden from the user. It isn’t really hidden, it just isn’t mounted to a drive letter or directory. Windows really doesn’t need drive letters or mount points. It is just as happy to use the volume GUID (see a previous post about Volume GUIDs here). It is just for our benefit that the various volumes on a computer has drive letters. It is a very good idea to not mount the system volume, that keeps users from messing with the boot critical files required for computer startup. It also makes it easy to enable BitLocker since the small unencrypted volume that loads the BitLocker driver is already in place. So in shot, good work Microsoft. But what if you’re a geek and really want to see what is on that volume? Fear not, it is quite easy.

The first thing we need to do is find the GUID of the system volume. The easiest way I know to do that is to run mountvol.exe. On a Windows 7 machine you will se one volume that has no mount points. That is probably your system volume. Just copy the GUID from the command prompt window and past it into the Run box. Windows will open a new explorer window with the contents of the system volume displayed, just like any other volume on the system. If you do not like the Run box, you can just type start.exe <Volume GUID> directly from the command prompt.

Here is the output from mountvol.exe on a test system:

Possible values for VolumeName along with current mount points are:

\?Volume{540a0153-2083-11de-9315-806e6f6e6963}
*** NO MOUNT POINTS ***

\?Volume{540a0155-2083-11de-9315-806e6f6e6963}
D:

\?Volume{540a0156-2083-11de-9315-806e6f6e6963}
E:

\?Volume{540a0157-2083-11de-9315-806e6f6e6963}
F:

\?Volume{540a0154-2083-11de-9315-806e6f6e6963}
C:

To open the system volume I just run this from the same command line:

start.exe \?Volume{540a0153-2083-11de-9315-806e6f6e6963}

And here is the result with the complete contents of the system volume:

But please remember to be careful when you poke around in here. Chances are your computer will not start if you do.