Ghost drivers, detect unknown device? Win10

[MrBlueBird]

Hey, My diskpart indicates that I have only one disk device.

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt

---

Disk 0 Online 447 GB 0 B

Veracrypt 1.25.9x64

when selecting devices it shows an unknown ghost drive, is it some software bug?

I found a similar thread on reddit with the same problem: https://www.reddit.com/r/VeraCrypt/comments/r9sg11/veracrypt_showing_a_hdd_which_does_not_exist/

[MrBlueBird]

Ok with the help of powershell managed to get the information

PS C:\WINDOWS\system32> get-volume
PortableBaseLayer NTFS Fixed Healthy OK 7.5 GB 8 GB

After the Win 1903 update it is probably a windows sandbox drive.

[idrassi]

Thank you for providing detailed information about the issue you encountered.

Based on your observations, it indeed looks like you're seeing a system-generated disk that corresponds to the Windows Sandbox feature which is an isolated environment designed to run untrusted applications safely. To achieve this, Windows creates a dynamic image (VHDX) that represents a clean Windows installation, which includes a base system image, user data, and the runtime state. The size of this image is typically around 8 GB, matching the "ghost" drive you observed.

When VeraCrypt enumerates devices on your system, it checks for all available disk devices using device path format "\Device\HardDiskX\PartitionY" without checking their physical nature. Hence, VeraCrypt lists \Device\HardDisk1\Partition1 even though you don't see it as a physical disk in diskpart.

Considering the potential confusion this might cause for other users, and noting an unanswered thread on Reddit regarding this issue, I will add this information to the VeraCrypt FAQ. This will hopefully assist others who might encounter a similar scenario.

[idrassi]

I pushed a commit (7f90222) to add this information to the FAQ and it is also published online at the bottom of https://veracrypt.fr/en/FAQ.html