When a user inserts a CD-ROM into a drives or attaches a USB camera, Windows detects the arrival and starts a process of examining the device or searching the medium. It is looking for properties of the device or content on the medium so that AutoPlay can present a set of meaningful options to the user. When the user makes a particular choice, they also have the option to make that selection automatic the next time Windows sees that content or device.^[2]

The AutoPlay dialog (in Windows XP and later) shows the result of a user placing a DVD into a DVD reader, in this case the D: drive. AutoPlay has determined that content is most likely a DVD movie and presents a set of actions to the user based on that decision. These actions are called Handlers and there are sets of Handlers associated with various types of content. The user can now make their decision and click OK to proceed. However, if they also tick the "Always do the selected action" tick box at this point, they will not be prompted the next time that particular content type is seen on that particular drive; the selected application will automatically start.

If a user regrets that decision or wishes to make automatic AutoPlay selections for any particular content type, the AutoPlay properties for any drive are accessible through the My Computer desktop icon. Selecting a drive and then "File/Properties" from the Windows Explorer menu, followed by the selecting the AutoPlay tab, gives a dialog similar to that shown. The content types can be selected with the drop down box. Here the dialog shows the Handlers available if AutoPlay ever determines the content type on drive D: to be "Pictures". Selecting an action to perform makes that action automatic for that user. Selecting "Prompt me each time to choose an action" deletes any association; AutoPlay will prompt the next time.

The content types available vary with the type of drive selected. Pictures, Music files and Video files are available with any drive. DVD and CD drives can also have "Music CD" or "DVD movie" and Windows Vista adds others like "Video CD movie" to the list.

"Mixed content" is the result of file content types falling into more than one of the Pictures, Music files or Video files content types. Note that a CD containing audio tracks is always considered to be a "Music CD" by Windows, regardless of the presence of data tracks.^[3] Therefore, a CD with Picture files, Video files and audio tracks is a "Music CD"; it is not "Mixed content".

If this is the result of the AutoPlay decision, the user is always presented with the AutoPlay dialog. This will contain a selection of applications deemed appropriate for the content found. Thus if Music files and Video files are both discovered on a flash drive, the user will get to choose from the Handlers for "Music files" along with the Handlers for "Video files". In this case, the user cannot make their selection the default one.

However, the AutoPlay properties dialog for any drive usually gives "Mixed content" as a content type option. The options available here are limited to actions that can handle any type of files, usually "Open folder to view files" is the only Handler listed here. This enables the user to make that action the default for Mixed content.

Certain types of devices do not appear as drive letters in "My Computer". These are called non-volume devices and AutoPlay handles them somewhat differently from volume devices like CDs and DVDs. Many digital cameras and video devices fall into this category.

As Windows cannot examine the files on the device to determine content type, it is left to the manufacturer to decide how to proceed. A manufacturer can register Handlers against their particular device, can add their device to a group of devices (e.g.: ZipDrives) or allow a device class (e.g.: all devices which are Video Cameras) to handle their device for them. This determines which Handlers will be listed in the AutoPlay dialog when their device is discovered.

As these types of devices do not have a drive letter, AutoPlay properties cannot be accessed and changed through "My Computer". However, when a device is attached, the discovery causes Windows to place an icon in the taskbar notification area (commonly referred to as the tray). AutoPlay preferences for this device can now be changed by clicking this icon. The adjacent image shows the icon that appeared when a video camera was attached.

On a new installation of Windows, a default set of handler applications are registered with the AutoPlay system.^[2] The following are the defaults with Windows XP SP2. The Action and Provider are simply strings stored within the Handler, they can vary to give the user a better idea of what will happen if they choose that action. They can also change to suit a user's preferred language. Many Handlers use the same Windows application; for example, Windows Media Player is used to play Music files as well as DVD movies. The word "using" is added by AutoPlay to join the two strings neatly.

Windows 95 and Windows 98 do have a primitive version of AutoPlay. Its sole job is to deal with Audio CDs, Video CDs and Movie DVDs and start an application to deal with them. If the new arrival does not fall into one of these categories Windows proceeds with the usual AutoRun process.^[4]

The action taken with Audio CDs and Movie DVDs essentially considers both types of media as if they were files; Explorer then simply performs the default action associated with that file type. File types and the actions associated with them can be viewed and changed from within any Explorer folder from the "File Types" tab of the "Tools/Folder Options" menu. They are stored in the Registry under HKEY_CLASSES_ROOT.

If the CD is a Red Book standard format Audio CD, then Explorer calls the default action registered for the AudioCD file type. This is normally set to "Play" and commonly calls cdplayer.exe.^[5]

If the DVD is a Movie DVD then Explorer calls the default action registered for the DVD file type. Movie DVDs are recognised by the existence of the file \video_ts\video_ts.ifo. The action for DVD is also normally set to "Play" and commonly calls dvdplay.exe.

The fact that the check for Audio CDs and Movie DVDs is done before AutoRun has implications for disabling the automatic playing of these types of media. Disabling AutoRun via the Registry or Group Policy or looking for QueryCancelAutoPlay messages within an application does not prevent these media types from automatically playing on insertion.^[6]

However one can disable Audio CDs by editing the file type for AudioCD and clicking "Set default". This will remove the Play action as the default for that file type. Alternatively, changing the (Default) entry under the HKEY_CLASSES_ROOT\AudioCD\Shell key to "" (a blank string) will accomplish the same thing. The disabling action for Movie DVDs is the same, with "DVD" used in place of "AudioCD".

The pertinent Registry settings are shown below along with their defaults in Windows 98SE:

HKEY_CLASSES_ROOT\AudioCD\shell
    (Default)    "Play"

HKEY_CLASSES_ROOT\AudioCD\shell\play
    (Default)    "&Play"

HKEY_CLASSES_ROOT\AudioCD\shell\play\command
    (Default)    "%SystemRoot%\cdplayer.exe /play %1"

HKEY_CLASSES_ROOT\DVD\shell
    (Default)    "Play"

HKEY_CLASSES_ROOT\DVD\shell\play
    (Default)    "&Play"

HKEY_CLASSES_ROOT\DVD\shell\play\command
    (Default)    "%SystemRoot%\system32\dvdplay.exe /play %1"

If a file called autorun.inf exists in the root directory of the file system, settings in that file can add to the options presented to the user or affect the view AutoPlay has of the content. Under Windows XP, the existence of this file may affect the process flow – AutoRun can proceed to executing an application directly without user intervention. Under Windows Vista, AutoRun cannot bypass AutoPlay in this way; it can only add to the options presented to the user. The Inf handling section of the AutoRun article details when and whether AutoPlay is invoked.

The AutoRun layer initially consults Windows Registry values to decides whether to initiate actions for any particular drive or drive type. If AutoRun has been disabled for the newly discovered volume, then the process halts at that point, effectively disabling AutoPlay for that volume.

After AutoRun completes, AutoPlay initiates by doing an examination of the volume for content. This is called content sniffing. AutoPlay decides whether the volume is an Audio CD, movie DVD, a blank recordable medium (a CD-R, CD-RW, DVD+R etc.) or a generic volume which contains files.

In the case of a generic volume, AutoPlay starts with the root directory and searches the file system to a depth of four directory levels below the root directory to find file types that fall into certain categories or "content types".

If this search takes more than a second or so, a progress dialog shows the scanning process taking place. This dialog can easily be confused with an Explorer copy operation; however, no files are being copied or moved.

As far as AutoPlay sniffing is concerned, files fall into three main categories or "content types". Files outside these categories are not of interest:

Content is considered to be "Mixed content" if files fall into more than one of the three categories.

Content is considered to be Unknown if the content sniffing process finds no categorisable content. This does not mean that there are no files present, just no files falling into one or more of the above three content types. In this case AutoPlay opens an Explorer window on the root directory of the medium and the process flow finishes here.

In order to class files into the three content types, the PerceivedType value associated with various file extensions is used to make the category determination. PerceivedType can be set to "image", "audio" or "video" to class files into Pictures, Music or Video content types respectively. There are other PerceivedTypes known to Windows (text, compressed, system and application) but these are not relevant to AutoPlay.

All file type information is stored in the Registry under HKEY_CLASSES_ROOT. The following is the PerceivedType Registry information for .avi Video files and .mp3 Music files:

HKEY_CLASSES_ROOT\.avi
    (Default)        "avifile"
    PerceivedType    "video"

HKEY_CLASSES_ROOT\.mp3
    (Default)        "mp3file"
    PerceivedType    "audio"

The EventHandler is the title of a table that makes an association between various Handlers and the triggering Event. In the case of volume-based events, the EventHandlers are generated completely internally to AutoPlay with no reference to the Registry.

Note that examination of the AutoPlayHandlers section of the Windows Registry reveals the ContentTypeSniffers and ContentTypeHandlers keys. Off these keys, various subkeys and values would appear to relate to and even control volume-based AutoPlay. However, as of Windows XP SP2, these keys are defined solely for future use and are not accessed by AutoPlay.^[7]

One of the following predefined EventHandlers are chosen based solely on the decision AutoPlay makes internally after volume examination and content sniffing:

As Windows cannot perform content sniffing on non-volume devices, AutoPlay analyses these devices by their characteristics rather than by their content. Every newly discovered device has identification information, normally stored within the device itself. This information is gather by enumerators and is used to build identification strings which Windows refers to when accessing and referring to the device. An identification string for a particular device is called a Device ID.^[9]

In order to uniquely identify each instance of each device that is installed, Windows assigns an Instance ID to each device. This ID contains location information, or a serial number if supported.

Combining the Device ID with the Instance ID gives a string which uniquely identifies an individual device in a system. This is the Device Instance ID. An example of a string from a PCI device is:

PCI\VEN_1274&DEV_1371&SUBSYS_8030107B&REV_04\0&0E

When Windows discovers a new device, it stores the Device Instances in the Registry from:

HKLM\SYSTEM\CurrentControlSet\Enum

The Windows Device Manager (Located under the System icon in the Control Panel) will reveal the Device Instance ID for any particular device. Getting the Properties of any device, selecting the Details tab of the Properties dialog and selecting "Device Instance ID" from the drop down box will retrieve the information.

Another characteristic of every device is the Device Interface Class.^[10] This defines an interface contract, where a device agrees to support a basic set of Input/Output Control calls pertaining to that Device Interface Class. For example, a device agreeing to support the keyboard interface contract must support the IOCTL_KEYBOARD_QUERY_ATTRIBUTES IOCTL call, amongst others. Each class is represented as a large universally unique number called a GUID.

A device can register many Device Interface Class GUIDs for itself, contracting to support various appropriate interface calls. The most common Interface Class GUID relating to storage devices is the Volume Device Interface Class GUID, {53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}.

Device Interface Class GUIDs can be found in the Registry under:

HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses.

When a non-volume device is being analysed, AutoPlay looks in several places in the Registry for a DeviceHandlers entry. This is simply a string which, when combined with other information, selects an EventHandler (which tables the Handlers). The DeviceHandlers entries are commonly placed into the Registry by the manufacturer of the device. There are also broader categories of devices which have preassigned DeviceHandlers, Video Camera devices for example.

The first place AutoPlay looks is under the Device Parameters key of the device instance. For example:

USB\Vid_059b&Pid_0031&REV_0100

is the USB device identification string for an Iomega USB ZIP drive. Combined with a USB serial number, say 059B003112010E93, this forms the Device Instance ID for the device. Thus the Device Parameters key is found at:

HKLM\...\Enum\USB\Vid_059b&Pid_0031\059B003112010E93\Device Parameters
    Icons             ""
    NoMediaIcons      ""
    Label             ""
    DeviceHandlers    "ZipDeviceHandler"

The DeviceHandlers value in this case is "ZipDeviceHandler". Other device parameters may also be present here: Icons may specify an icon to represent the device along with NoMediaIcons to represent the device when it has no media present. Label specifies a friendly name for the device.

If no DeviceHandlers entry is found under the device instance, AutoPlay checks for the existence of a DeviceGroup entry, again under the device instance. This allows a whole set of devices to share device parameters.

HKLM\...\Enum\USB\Vid_059b&Pid_0031\059B003112010E93\Device Parameters
    DeviceGroup    "ZipDrive100"

The parameters for this device group are stored in:

HKLM\...\AutoPlayHandlers\DeviceGroups\devicegroup

So for the ZipDrive100 group example:

HKLM\...\AutoPlayHandlers\DeviceGroups\ZipDrive100
    Icons             "%SystemRoot%\system32\shell32.dll,-230\0\0"
    Label             "Zip Drive 100"
    DeviceHandlers    "ZipDeviceHandler"

Lastly, AutoPlay searches the relevant Device Interface Class GUIDs. The parameters for device classes are stored in:

HKLM\...\AutoPlayHandlers\DeviceClasses\{classguid}

Here is the entry that the Microsoft application Movie Maker registers for any and all Video Camera devices:

HKLM\...\AutoPlayHandlers\DeviceClasses\{CC7BFB41-F175-11D1-A392-00E0291F3959}
    DeviceHandlers    "VideoCameraDeviceHandler"
    Label             "@C:\Program Files\Movie Maker\wmm2res.dll,-63094"
    Icons             "C:\WINDOWS\system32\shell32.dll,-317\0\0"

• AutoRun

Software providing similar functionality in other environments

• gnome-volume-manager in GNOME
• Thunar (using the thunar-volman plugin^[11]) in Xfce