The Mysterious Local Disk Z

What is Local Disk Z, why can't you access it, and what can you safely do with it.



  1. Regedit32
    This Article will cover three topics on same theme:
    • Part 1: Hiding the Local Disk Z.
    • Part 2: Explanation of the method to hide a Disk / Partition and the various values required to do this.
    • Part 3: How to secure a Drive / Partition from being accessible

    Part 1

    After seeing a new thread today I was reminded of an old Registry tweak, but was also interested in the issue of this mysterious appearance of Local Disk Z in the User's File Explorer window. What is this? Why can't you access it? Is it safe to delete or do anything else with?

    After doing some basic research on this, I discovered there are two scenarios when a User may see this mysterious Local Disk Z appear.
    1. The User happens to own a Hewlett Packard computer and is running the HP Support Software on this machine.

      It turn's out some HP models, generally Notebooks, but not exclusively, will accidently reveal a hidden Virtual Drive Partition, that being displayed in the User's File Explorer window as Local Disk Z. This is inaccessible. The size can vary but typically is around 256 MB, although this can be smaller or larger.

      The glitch seems to occur more so if the User's BIOS has UEFI mode enabled.

      The glitch has been around since Windows 7, and continued into Windows 8, 8.1 and now Windows 10

    2. The Windows Update Service can make use of Virtual Drive Partitions also for the purpose of unpacking temporary files, which can be used to install the update, or roll back the update in the event it fails. For some Windows 10 Users this is displayed in their File Explorer window too as Local Disk Z. Again, the size will vary. The drive is inaccessible, but unlike the Hewlett Packard glitch, this one will eventually disappear (typically after 30 days; similar to the $BT folders Windows creates when you install an OS).
    Note: The Local Disk Z cannot be viewed via Disk Management.

    As I researched this I discovered a number of threads in the Hewlett Packard forums, some of which gave quite good advice about what the mysterious Local Disk Z was, but unfortunately many posts gave shocking advice on ways to move, and delete this partition, using anything from third party Partition managers, to Diskpart or Subst commands in the Windows Administrator Command Prompt.

    Likewise, there were also videos posted on YouTube repeating this poor advice along with demonstrations on how to do it. There are also YouTube videos showing how to modify the Registry using the value I'm about to discuss here, but again unfortunately, whoever made this video, apart from the annoying sniffle issue he had while recording the video, also imparted a load of complete nonsense on what, how, and where to do the modifications.

    This simple truth here is whilst perhaps a little annoying the actual Data on this partition is needed. Moving it, or deleting it will compromise your Systems Health.

    That is when it occurred to me why not just make use of an old Registry Tweak that has been around since Windows XP was released. I refreshed my memory of this tweak by first consulting Microsoft's TechNet website on the subject ( a reference to this will be provided at the end of article ), then got to playing around inside my test machine to verify it would work and not create other issues.

    So given we ought not move or delete the partition, given the Data contained inside it is needed, we are left with one of two choices:
    1. Ignore it and accept it will appear in our File Explorer
    2. Hide it, whilst keeping the Data

    How to Hide Local Disk Z (Keeping the Data on it safe):
    • This is a relatively simple process of modifying a single Registry key by adding a 32-bit DWORD value of NoDrives to our Explorer Policies.
    • To do this you can either open your Registry Editor and make the modification, or use an elevated Command Prompt console.
    Using the Registry Editor
    • Press Windows key + R key together to open the Run dialog
    • In the Run dialog type regedit then click OK
    • When the User Account Control prompt appears click Yes
    • In the left pane of the Registry Editor window expand the keys to the following location:
    HKEY_LOCAL_MACHINE
    — SOFTWARE
    — Microsoft
    — Windows
    — CurrentVersion
    — Policies
    Explorer
    • Now in the left pane simply right-click on Explorer and select New > DWORD (32-bit) Value as in image below:
    image1.png

    • This will create a DWORD with the name New Value #1 in the right-pane which is currently highlighted. Overtype this to rename it NoDrives then press Enter key
    • Now right-click on NoDrives and select Modify which will open an Edit DWORD (32-bit) window. In this window check the radio button next to Decimal and then in the Value data field type 33554432 and click OK
    Sample images

    image2.png

    Doing the above will result in this:

    image3.png

    • Press F5 key to refresh Registry Editor, then close the Registry Editor window
    • Right-click on your Taskbar and select Task Manager
    • Select the Processes tab then scroll down or tap W key until you see Windows Explorer
    • Right-click on Windows Explorer and select Restart
    Sample image

    explorer.png


    The screen will darken/flash then return you to Desktop.

    Done! You will now no longer be able to see Local Disk Z in your File Explorer window. The partition still exists and its Data is safe and sound.

    Note: To reverse this simple do one of the following in the Registry Editor:


    Either:

    Right-click on NoDrives and select Modify then replace Data value field content with 0 and click OK, then press F5, close Registry Editor, and Restart Windows Explorer.

    Or:

    Right-click on NoDrives and select Delete, then press F5, close Registry Editor, and Restart Windows Explorer.



    Using an Elevated Command Prompt Console
    • Press the Windows key + S key together to give focus to Search/Cortana field
    • In the Search/Cortana field type comm
    • In the search results right-click on Command Prompt and select Run as administrator
    • When the User Account Control prompt appears click Yes
    • In the Administrator: Command Prompt console type or copy & paste the following:
    Code:
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 33554432 /f
    Press Enter key

    Sample image

    cmd.png

    Type Exit then press Enter key

    • Right-click on Taskbar and select Task Manager
    • Select the Processes tab then scroll down or tap W until you find Windows Explorer
    • Right-click on Windows Explorer and select Restart
    The screen will darken/flash then return you to Desktop.

    Done! You will now no longer be able to see Local Disk Z in your File Explorer window. The partition still exists and its Data is safe and sound.

    Note: To reverse this simply type or copy & paste one of the following into an Elevated Command Prompt:

    Either:

    Code:
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0 /f


    Press Enter key then close the Administrator: Command Prompt and restart Windows Explorer.

    Sample image

    cmd3.png


    Or:

    Code:
    REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives


    Press Enter key then close the Administrator: Command Prompt and restart Windows Explorer.

    Sample image:

    cmd2.png


    Part 2

    The use of the Registry to control whether a User can view a Local Disk Drive / Partition has been around since Windows XP.

    Microsoft published an article on this via their TechNet Forum at the time.

    As seen in Part 1 this involves modifying the policies of the Explorer key within the Windows Registry for the current user.

    Within the Windows operating system, there are 26 letters that can be assigned to a partition or local drive, A - Z. Historically, A and B are reserved for floppy drives, whilst C is reserved for Windows. This of course can be altered by the User or an IT member who can substitute a partition assignment or change it using commands we will not go into in this article. With the modern User who may be dual booting their computer, partition assigned to Windows could for example be D, E or some other letter, although this will be determined by the number of USB ports they have, as typically drives F through to K are assigned to USB ports, and D or E are commonly assigned to CD/DVD Rom drives.

    Coming back to our NoDrives DWORD (32-bit) value, the User can choose to hide one, two, or all twenty-six Local Disk's / Partitions from view within File Explorer. In Part 1 you are shown how to hide Local Disk Z.

    Note: When Microsoft names Local Disk they are actually referring to a partition, not a literal hardware component.

    To be able one, two, or all twenty-six possible partitions, you need to add the DWORD (32-bit) value NoDrives then assign this with a unique Data value in hexadecimal or its Decimal equivalent. As there are 26 possible partitions (including Virtual drives) the Hexadecimal range is 0x0 — 0x03FFFFFF.

    Microsoft offer this simple table to illustrate the Hexadecimal values and the result in using them as seen below.

    Table1.png

    Basically, you can restrict an individual drive, or a group of drives, or all the drives.

    When restricting a group of drives you simply add up their hexadecimal values to get a total value, and this becomes the value to use.

    So for example, you want to restrict Drives A, B and C, then add their hexadecimal values up: Drives A and B has a hexadecimal value of 0x3, and Drive C has a value of 0x4. 3 + 4 = 7, so to restrict Drives A, B and C assign the hexadecimal value of 0x7 to the Data value of the NoDrives DWORD (32-bit) value.

    Now let's face it, we're not all Computer Scientists, or Mathematicians, so to make things a little easier, we can apply the same rule to the equivalent Decimal values for each drive, then when modifying the NoDrives DWORD (32-bit) value simply check the radio button next to Decimal value before adding the Decimal value to the Data value field, if using the Registry Editor, or use the Decimal value when executing a command line via an elevated Command Prompt. That is precisely what I did in Part 1.

    Here is a complete list of Decimal value for drives A - Z to help you out.

    Table2.png

    You can see each Drive letter increase by the power of 2.

    To disable drives A - Z, you would add all the Decimal values together, then when modifying the NoDrives DWORD (32-bit) value would place for the Decimal value in the Data field, 67108863 or if you were restricting drives A and E, then 1 + 16 = 17, so you'd use 17 as the value.

    For more information about this Registry modification refer to Microsoft's TechNet website article located here: https://technet.microsoft.com/en-us/library/cc938267.aspx


    Part 3

    Finally, this brought to mind another useful Registry tweak one can do should they wish to restrict access to one, two or more drives.

    If you make this choice, whilst the Local Drive may be visible in File Explorer, or Disk Management, the user will not be able to open it to view its sub-folders or files.

    This is actually a simple way to provide the home user some security from a family members prying eye, unless of course they have Administrators privileges and know how to remove the modification :eek:.

    Just as with the restriction of viewing a Drive using NoDrives DWORD (32-bit) value and applying the appropriate Hexadecimal or its Decimal equivalent to the Data field, this tweak uses the same location in the Registry, but obviously a different DWORD (32-bit) value; that value being named NoViewOnDrive.

    Thus, as in Part 1 there are two ways to go about doing this:
    1. Using the Registry Editor, or
    2. Using an elevated Command Prompt.
    Note: For the purpose of demonstration we'll pretend we wish to prevent a User accessing Drive Y which has a Decimal Value of 16777216

    Using the Registry Editor
    • Press Windows key + R key together to open the Run dialog
    • In the Run dialog type regedit then click OK
    • When the User Account Control prompt appears click Yes
    • In the left pane of the Registry Editor window expand the keys to the following location:
    HKEY_LOCAL_MACHINE
    — SOFTWARE
    — Microsoft
    — Windows
    — CurrentVersion
    — Policies
    Explorer

    • Now in the left pane simply right-click on Explorer and select New > DWORD (32-bit) Value as in image below:
    image1.png

    • This will create a DWORD with the name New Value #1 in the right-pane which is currently highlighted. Overtype this to rename it NoViewOnDrive then press Enter key
    • Now right-click on NoViewOnDrive and select Modify which will open an Edit DWORD (32-bit) window. In this window check the radio button next to Decimal and then in the Value data field type 16777216 and click OK
    Sample image of final result

    reg1.png

    • Press F5 key to refresh Registry Editor, then close the Registry Editor window
    • Right-click on your Taskbar and select Task Manager
    • Select the Processes tab then scroll down or tap W key until you see Windows Explorer
    • Right-click on Windows Explorer and select Restart
    The screen will darken/flash then return you to Desktop.

    Done! You will now no longer be able to view the contents of Local Disk Y. The partition still exists and its Data is safe and sound.


    Note: To reverse this simple do one of the following in the Registry Editor:

    Either:


    Right-click on NoViewOnDrive and select Modify then replace Data value field content with 0 and click OK, then press F5, close Registry Editor, and Restart Windows Explorer.


    Or:


    Right-click on NoViewOnDrive and select Delete, then press F5, close Registry Editor, and Restart Windows Explorer.

    Using an Elevated Command Prompt

    • Press the Windows key + S key together to give focus to Search/Cortana field
    • In the Search/Cortana field type comm
    • In the search results right-click on Command Prompt and select Run as administrator
    • When the User Account Control prompt appears click Yes
    • In the Administrator: Command Prompt console type or copy & paste the following:
    Code:
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoViewOnDrive /t REG_DWORD /d 16777216 /f
    Press Enter key

    Sample image:


    cmd4.png

    Type Exit then press Enter key

    • Right-click on Taskbar and select Task Manager
    • Select the Processes tab then scroll down or tap W until you find Windows Explorer
    • Right-click on Windows Explorer and select Restart
    The screen will darken/flash then return you to Desktop.

    Done! You will now no longer be able to view the contents of Local Disk Y. The partition still exists and its Data is safe and sound.

    Note: To reverse this simply type or copy & paste one of the following into an Elevated Command Prompt:

    Either:

    Code:
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoViewOnDrive /t REG_DWORD /d 0 /f


    Press Enter key then close the Administrator: Command Prompt and restart Windows Explorer.

    Sample image:

    cmd5.png

    Or:

    Code:
    REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoViewOnDrive


    Press Enter key then close the Administrator: Command Prompt and restart Windows Explorer.

    Sample image:

    cmd6.png

    As in Part 2 if you want to restrict viewing to multiple drives, simply add their decimal values when modifying the NoViewOnDrive DWORD (32-bit) value. The table of Decimal values is above in Part 2.

    Reference: https://technet.microsoft.com/en-us/library/cc959437.aspx


    Regards,

    Regedit32
    AdamLenskyj, Data, Ian and 1 other person like this.