Can/Why Does A Hard Drive Serial Number Change

Question

Our anti-piracy software identifies people according to their Hard Drive Serial. This I believe is a constant feature and will not change unless the user changes their primary physical drive - correct me if I am wrong? We use the WMI python module to obtain the users Hard Drive Serial Number.

For 2 of our test computers the Hard Drive serial number has changed. But we haven't changed their hard drive at all.

What could cause such a problem? Is our code that identifies the serial not comprehensive across windows operating systems? I did notice that this post mentions you can get the wrong serial if a standard user process retrieves the serial no. But in our case the error has occurred on an admin user aswell.

Some important information:

• Both of these test nodes run Windows 8 Professional
• One computer is a Toshiba laptop
• The other computer is an Acer Iconia tablet
• The tablet was recently updated from Windows 8 to Windows 8.1 and I noticed that the serial changed after this update
• The laptop has an admin user who experienced the issue. The tablet has a standard user who experienced the issue.

Also is the Hard Drive Serial number the MAC address of the hardware device or something else?

Code to obtain the Hard Drive Serial number:

c = wmi.WMI()
for item in c.Win32_PhysicalMedia():
    if "PHYSICALDRIVE" in str(item.Tag).upper():
        serialNo = item.SerialNumber
        break

Edit: A short script that retrieves a users Hard Drive Serial number as a normal process and as an elevated/admin process.

Note: For me it outputs exactly the same serial number no matter as a user or as a admin. Does this script do the same for you aswell?

import os
import sys
import wmi
import win32com.shell.shell as shell
ASADMIN = 'asadmin'

def get_elevated_privleges():
    if sys.argv[-1] != ASADMIN:
        script = os.path.abspath(sys.argv[0])
        params = ' '.join([script] + sys.argv[1:] + [ASADMIN])
        shell.ShellExecuteEx(lpVerb='runas', lpFile=sys.executable, lpParameters=params)


def get_hard_drive_serial():
    c = wmi.WMI()
    for item in c.Win32_PhysicalMedia():
        if "PHYSICALDRIVE" in str(item.Tag).upper():
            return str(item.SerialNumber)

    return None


print "HD Serial as Regular User: " + get_hard_drive_serial()
get_elevated_privleges()
print "HD Serial as Admin User: " + get_hard_drive_serial()

Answer 1

I know this is a bit of an old thread, but I have just had the same issue, using the drive's serial number as a key. I thought it would be good to document my findings somewhere.

One thing I noticed was that somewhere between Windows 7 and Windows 8.1, there seems to have been a change in how the WMI routines return the drive serial number.

I have masked out some characters.

Windows 10  reports: [S21D********04F]
Windows 8.1 reports: [S21D********04F]
Windows 7   reports: [2SD1********40 F]

It seems that W7 and below are not byte-swapping the drive info.

Answer 2

Our anti-piracy software identifies people according to their Hard Drive Serial. This I believe is a constant feature and will not change unless the user changes their primary physical drive - correct me if I am wrong?

In normal usage the serial number should not change, but it is possible for a user to change it if they are trying to bypass your anti-piracy technique. See here for a list of tools that do this, aimed at people trying to bypass anti-cheat systems in games. So you have to consider whether the hard disk serial number is "good enough" to deter most people from pirating your software.

What could cause such a problem? Is our code that identifies the serial not comprehensive across windows operating systems?

See this forum thread. Results are varying depending on Windows version, on whether the code is run as admin or not, and whether the Win32_PhysicalMedia class is used or the Win32_DiskDrive class. Seems pretty unreliable, you may have to write your own abstraction layer to handle it yourself, as described in these forum posts.

I tried it myself and found I got two different serial numbers depending on admin vs normal and Win32_PhysicalMedia vs Win32_DiskDrive:

VB38bb50ab-0de50c12 

and

42563833626230356261302d6564303531632032

Notice that the second string is actually a hex-encoded and byte-reversed version of the first string! Maybe the same is happening to you?

is the Hard Drive Serial number the MAC address of the hardware device or something else?

A MAC (Media Access Control) address only relates to network interfaces, nothing to do with hardid disks. The hard drive serial number is an arbitrary string set by the hard disk manufacturer - it can be anything and only has meaning to the manufacturer, it could even be blank if the manufacturer does not implement it.