power button shutdown and its impact on the write filter flush

[NiBE]

Hi,
I have write an application in C# which is the main shell on my WinXpe.
This software sometimes write on Registry, the problem is that the machine
is never shutdown gracefully.
So when it restarts the cahnges made on registry is never recorded.
The WinXpe boot from an USB key (2Gb) and EWFT overlay now is set on RAM Reg.
Im gonna mad with this problem, any adivce will be very appreciated

thanks a lot

NiBE

 

[Mike Warren]

Hi,
I have write an application in C# which is the main shell on my
WinXpe. This software sometimes write on Registry, the problem is
that the machine is never shutdown gracefully.
So when it restarts the cahnges made on registry is never recorded.
The WinXpe boot from an USB key (2Gb) and EWFT overlay now is set on
RAM Reg. Im gonna mad with this problem, any adivce will be very
appreciated

I'm not sure I can be any help as I don't know anything about C#.

Have you tried opening the drive and using FlushFileBuffers().

Another suggestion is to see if your C# registry writing function has a
property called LazyWrite or similar. Try setting that to false.

I notice in your other post that you say that it works ok if you do a
controlled shutdown. Is this problem only occurring when power is
removed from your device?

 

[NiBE]

Hi,
well my application works ok, that means registry keys is set properly, when
I shutdown gracefully. The problem happens only when power is removed from my
device.
It's not only a spftware problem because if I open regedit and change a
value, then remove the power it is not recorded, after reboot the value I
changed before is not showen.
I try to make a kind of commit with ewfmgr c: -commitanddisable -live but it
doesn't work, I suppose because I boot from a USB key.
Now I'm trying to use fbwf manager...but if anybody have a bettere solution,
please let me know

thanks a lot

nibe

 

[Mike Warren]

well my application works ok, that means registry keys is set
properly, when I shutdown gracefully. The problem happens only when
power is removed from my device.

Ok, this is the critical bit

Windows caches files to fixed disks, and USB disks are treated as fixed
when USB boot is used. See if there is a way to use FlushFileBuffers in
C#, open the drive eg: \\.\C: and run FlushFileBuffers on it.

This is how I do it in Delphi:

S := '\\.\' + Dest[1] + ':';
DebugMsg('Flushing ' + S);
hDrive := CreateFile(
PAnsiChar(S), GENERIC_READ or GENERIC_WRITE,
FILE_SHARE_READ or FILE_SHARE_WRITE,
nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
OSFlushed := FlushFileBuffers(hDrive);
CloseHandle(hDrive);
if OSFlushed then
begin
DebugMsg('Successfully flushed ' + S);
Break;
end else
DebugMsg('Failed to flush ' + S);

I don't know that this will fix your problem but it fixed a similar
problem with hard drives for me.

 

[NiBE]

I just modify some registry key values, what I do now commit the registry
changed, but I think it's a low level matter, indeed the problem remains

well my application works ok, that means registry keys is set
properly, when I shutdown gracefully. The problem happens only when
power is removed from my device.

Ok, this is the critical bit

Windows caches files to fixed disks, and USB disks are treated as fixed
when USB boot is used. See if there is a way to use FlushFileBuffers in
C#, open the drive eg: \\.\C: and run FlushFileBuffers on it.

This is how I do it in Delphi:

S := '\\.\' + Dest[1] + ':';
DebugMsg('Flushing ' + S);
hDrive := CreateFile(
PAnsiChar(S), GENERIC_READ or GENERIC_WRITE,
FILE_SHARE_READ or FILE_SHARE_WRITE,
nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
OSFlushed := FlushFileBuffers(hDrive);
CloseHandle(hDrive);
if OSFlushed then
begin
DebugMsg('Successfully flushed ' + S);
Break;
end else
DebugMsg('Failed to flush ' + S);

I don't know that this will fix your problem but it fixed a similar
problem with hard drives for me.

 

[Mike Warren]

I just modify some registry key values, what I do now commit the
registry changed, but I think it's a low level matter, indeed the
problem remains

Two questions:

1/ Are you able to use FlushFileBuffers? Does it exist in C#?

2/ Does it still fail if EWF is disabled?

 

[NiBE]

Hi Mike,
I fix the problem calling RegFlushKey from advapi32.dll each time I write on
registry, independently if I use EWF or FBWF.
Hope this will be useful also for other people

thanks for you support