A disk serial number is assigned by the drive manufacturer and stored in the device's firmware. It is not the volume serial number Windows shows in a directory listing, and confusing the two is behind a great deal of bad advice. The volume serial is a filesystem property. It is generated when you format a partition and changes when you reformat. It is trivially readable and trivially changed, which is why anti-cheats treat it as weak evidence. The hardware serial lives in the drive firmware and is read by querying the storage controller directly, through SCSI pass-through, ATA identify commands or NVMe identify. Formatting does not touch it. Repartitioning does not touch it. Reinstalling Win
is assigned by the drive manufacturer and stored in the device's firmware. It is not the volume serial number Windows shows in a directory listing, and confusing the two is behind a great deal of bad advice.
is a filesystem property. It is generated when you format a partition and changes when you reformat. It is trivially readable and trivially changed, which is why anti-cheats treat it as weak evidence.
lives in the drive firmware and is read by querying the storage controller directly, through SCSI pass-through, ATA identify commands or NVMe identify. Formatting does not touch it. Repartitioning does not touch it. Reinstalling Windows does not touch it. Only replacing the drive does. That distinction explains the most expensive mistake in this area: people wipe a drive or reinstall Windows after a hardware ban, find themselves banned again, and conclude the ban is on the account. It is not — the drive is reporting the same firmware serial it always did. Anti-cheats read serials for
, not just the boot drive. A machine with an NVMe boot drive, a SATA SSD and a mechanical drive exposes three, and all three go into the fingerprint. This is also why replacing one drive rarely helps: the other two still match, alongside the motherboard and network adapters, as covered in what a spoofer is.
Because the serial is read from the drive rather than from Windows, spoofing has to happen between the two. That means a kernel driver, and it is the clearest example of why user-mode tools are inadequate. A user-mode tool can change what a WMI query returns. That satisfies a checker script and does nothing at all against an anti-cheat that issues a storage command directly to the controller. This is why some people report that a free spoofer showed a new serial in the interface and they were still banned — the interface was reading WMI, and the anti-cheat was not. A kernel-mode spoofer intercepts the device control requests themselves. When something asks the controller to identify the driv
Because the serial is read from the drive rather than from Windows, spoofing has to happen between the two. That means a kernel driver, and it is the clearest example of why user-mode tools are inadequate. A
can change what a WMI query returns. That satisfies a checker script and does nothing at all against an anti-cheat that issues a storage command directly to the controller. This is why some people report that a free spoofer showed a new serial in the interface and they were still banned — the interface was reading WMI, and the anti-cheat was not. A
intercepts the device control requests themselves. When something asks the controller to identify the drive, the driver returns substituted values. Because the interception sits below the point where the anti-cheat asks, the answer is consistent no matter which method it uses. A good implementation covers the awkward cases:
, which use a different command set from SATA and are a common gap;
, which are enumerated too; and
RAID or storage-space configurations
, where the controller may present differently from the physical drives. It also generates plausible values. A serial that does not match the format used by that manufacturer is a signal in itself — a Samsung NVMe reporting a serial in a Western Digital format is more suspicious than an unchanged one.
This is the practical conclusion and it is worth stating plainly, because it is the most expensive misconception in this subject. Fingerprints are composite. An anti-cheat hashing board serial, system UUID, three disk serials and four MAC addresses does not stop matching because one of those nine values changed. You have made the fingerprint slightly different, not different enough. You have to replace every drive, not one. People buy a new boot drive and keep their game library on the old one — which is still reporting the serial that was banned, to the same anti-cheat, from the same machine. The motherboard is usually the anchor. Board serial and system UUID are stable and heavily weighted
This is the practical conclusion and it is worth stating plainly, because it is the most expensive misconception in this subject.
An anti-cheat hashing board serial, system UUID, three disk serials and four MAC addresses does not stop matching because one of those nine values changed. You have made the fingerprint slightly different, not different enough.
You have to replace every drive, not one.
People buy a new boot drive and keep their game library on the old one — which is still reporting the serial that was banned, to the same anti-cheat, from the same machine.
The motherboard is usually the anchor.
Board serial and system UUID are stable and heavily weighted. Without replacing the board, drive changes rarely move the needle.
Money spent on drives is spent. A spoofer that does not work on your hardware costs you a subscription.
It does nothing about the rest.
Account, email, payment method and play style are all unaffected by new storage. The sensible order is to try a kernel-mode spoofer first, verify with the specific checks in the setup guide that every disk serial actually changed, and only consider hardware if that genuinely fails. The full cost comparison is in spoofer versus new PC, and the VOIDEX spoofer covers NVMe and SATA alongside board and network identifiers.