copying/modifying files on usb stick problem

[iimorpheus]

Hi, I've got my image up and running almost perfectly on a Via Epia board. I
plugged in a usb stick and copied some files from the target pc onto the
stick. But when I put the stick in another pc the files were not there. Same
result if i delete/modify any files on the stick while plugged into the xpe
pc, i pull it out then plug in again, the files revert back to how they were.
Kinda like EWF, but ive only got that set on one of the hdd partitions and
its currently disabled.
I built an image for a newer Via board a few weeks back and never had this
problem, I've tried to compare components but can't see anything obvious that
i've missed.
Any ideas for a noob?

 

[Srikanth Kamath [MSFT]]

My guess is that the USB key is messing with the ARC paths used by EWF.
Though it is not clear why it would mimic 'enabled' behavior

Could you please share the following info
** with the USB stick plugged in **

(1) ewfmgr /all
(2) reg query HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected
(For each volume listed there)
(3) What is the disk # and partition # for this USB stick. You can use
diskpart.exe to determine this. (use commands like "select disk #" ,"list
partition" etc)

Thanks
Srikanth

 

[iimorpheus]

Hi, here is the info you requested..

1: ewfmgr /all

Type: RAM(REG)
State: Disabled
Boot Command: NO_CMD
Param1 0
Param0 0
Vol ID 6A 5B BE 97 00 00 4E FD 32 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume3" [E:]
Max Levels 1
Clump Size 512
Current Level N/A

2: from the registry..

\Protected\Volume0\

ArcName = multi(0)disk(0)rdisk(0)partition(3)
Enabled = 0
Type = 1


3: from diskpart..

HDD is disk0, usb is disk1

detail disk 1..

USB Disk 2.0 USB Device
Disk ID: C3072E18
Type: USB
Bus: 0
Target: 0
LUN ID: 0

Volume 5, Letter H:, FAT32 etc..

detail partition..

Partition 1
Type: 0B
Hidden: No
Active: No

 

[Mike Warren]

I plugged in a usb stick and copied some files from the target
pc onto the stick. But when I put the stick in another pc the files
were not there. Same result if i delete/modify any files on the stick
while plugged into the xpe pc, i pull it out then plug in again, the
files revert back to how they were.

Just a guess: Are you using "USB NT Hardware Detect" in your image?

If so, files to all USB drives are buffered so they will often not be
written before you unplug the drive.

 

[iimorpheus]

I can't see any component in my build called USB NT Hardware Detect, can't
even find it in the component tree on the left.
I did notice though that I have USB Boot 2.0 and USB Boot Mass Storage
Device enabled, which I didn't have on the image I made for a different pc.
You think that could be the problem?

 

[Mike Warren]

I did notice though that I have USB Boot 2.0 and USB Boot Mass Storage
Device enabled, which I didn't have on the image I made for a different
pc.
You think that could be the problem?

Yes. USB Boot causes all USB drives to show as fixed drives.

 

[Mike Warren]

I can't see any component in my build called USB NT Hardware Detect,
can't even find it in the component tree on the left.

Set your visibility to 100. You probably still have it set at the default
of 1000.

 

[iimorpheus]

I changed the visibility, removed usb nt and boot components, all working
good now

thanks for the help

 

[Richard]

Mike, is there a way to work around this? For instance, 1 USB Stick is for
the OS/Booting/ EWF and the 2nd USB Drive is used for configuration storage
and log files and not EWF Protected.

Richard

 

[Mike Warren]

Mike, is there a way to work around this? For instance, 1 USB Stick
is for the OS/Booting/ EWF and the 2nd USB Drive is used for
configuration storage and log files and not EWF Protected.

Yes. The problem is not that the drive is protected by EWF. Rather, any
writes to the drive are buffered as if it was a hard drive, so if the the
flash drive is unplugged too soon, the buffer has not been flushed.

It may be possible to force flush the drive by doing something like
this: (I use this for flushing hard drives)

procedure FlushDrive(Drv: Char);
var
S: string;
hDrive, I: Integer;
Success: Boolean;
begin
for I := 1 to 2 do
begin
S := '\\.\' + Drv + ':';
DebugMsg('Flushing ' + S);
hDrive := CreateFile(
PAnsiChar(S), GENERIC_READ or GENERIC_WRITE,
FILE_SHARE_READ or FILE_SHARE_WRITE,
nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
Success := FlushFileBuffers(hDrive);
CloseHandle(hDrive);
if Success then
begin
DebugMsg('Successfully flushed ' + S);
Break;
end else
DebugMsg('Failed to flush ' + S);
end;
end;

I've been running a test machine 24/7 for about the last year that has 2
USB flash drives. One contains the OS and is protected by EWF, and the
other has my software and other files including logs.

The logs are a bit of a problem. In order to reduce the number of writes
to the flash memory, I divided the log into 100 fixed size files, which
get alternately written to, hoping that would increase the life of the
drive. Unfortunately, some common data (I guess the file table) is
written every time any file is written to, so the drive became corrupted
within a few weeks. Reformatting it fixed the problem, and I've disabled
logging in my program at the moment. I'm not putting a lot of effort
into the project as it is unlikely to ever become more than an
experiment.

 

[Richard]

Thanks,
My logs are not written very often at all. I log data in memory and when a
remote machine has a problem and goes down, then I write the data points to
a log file on USB for review.

I have about 5 to 6 years doing it like this and never had a corrupt USB
drive. I've only had 2 or 3 corrupt CF cards but it was caused from losing
power during a Commit and Reboot command. The user did a commit then
manually turned off the device

Richard