603 replies to this topic

[erwan.l]

Has anyone ever really had this problem?
Within XP there are two kinds of setups/installs in regard to registry settings. The one does overwrite existing settings, the other one does not.

You mean the usb drivers reverting to start<>0?
That should be easy to test : I'll plug my xp usb pen tomorrow and will plug another usb device in (a webcam or a usb hdd).
I'll quickly see if at next reboot I get a 0x7b bsod.

Regards,
Erwan.

[MedEvil]

Yes, i somehow seriously doubt, that pluging in a new device, will even cause a reinstall of the drivers for the USB ports.
Just makes no sense.

[Wonko the Sane]

Has anyone ever really had this problem?

Yes.

Yes, i somehow seriously doubt, that pluging in a new device, will even cause a reinstall of the drivers for the USB ports.
Just makes no sense.

Keep doubting, it's a good thing , but assuming that MS makes something that actually does make sense is possibly a bit too abstract to be taken as a plausible assumption.

You can also use a Group Policy:
http://support.micro...kb/555324/en-us

But results have been reported to be INconsistent:
http://www.intelliad...b-flash-drives/

After loading about 10 different variations of Windows (2000, XP, 2003, and Vista with different service packs) in VMWare we started to see a clearer picture.

Some variations will simply reset the key ‘Start’ back to 3 when a new flash drive is plugged in. The first trick we tried was denying write access for the system account on the USBStor registry key.

It worked on everything except Windows 2003. This version of windows would reset permissions on the key – and delete it!. Then it would re-create with the USB storage enabled.

Completely UNrelated, but not much , USB support can be "shaky":
http://support.micro...kb/892050/en-us

There are several reports around, (by people that actually used the original Dietmar's methods):
http://forums.ngine....php?f=4&t=20154

A last thing to watch for, is the USBSTOR service in registry. It has a tendency to reset to start (3) again. If you experience a no-boot situation, check this service first to make sure the Start type is (0) and not (3).

It is very possible that Windows 7 behaves differently from what XP and other windows versions did/do, though, even then, it wasn't a situation that happened "every time", but something that could (and did sometimes) happen, the whole point of the usbbootwatcher service is to make sure it doesn't happen.

So, you can ignore the service, and continue doubting, if a reset of the START value doesn't happen to you, good , if it does, add the service or manually set back the key to the intended value.


Wonko

[MedEvil]

Strange how complicated some people solve simple problems.
If this problem is real, how you say, i would have simply created an extra set of registry keys, with a different name but the same contents as the original USB keys and then changed for those the start and group.

[Wonko the Sane]

Strange how complicated some people solve simple problems.
If this problem is real, how you say, i would have simply created an extra set of registry keys, with a different name but the same contents as the original USB keys and then changed for those the start and group.

I don't get it.

If you have a problem, find a way to solve it (and possibly share the working result).

If you don't have a problem don't solve it.

Philosophy on how other people solved a problem seems to me foolish, until you have tested your "simpler" solution (which BTW I cannot understand without further explanations from you) and it works.

What do you mean an extra set of keys with a different name?

I presume that the drivers (or whatever looks for the set of keys in the Registry) have a number of hardcoded keynames, can you explain your proposed solution AND also provide a working example of it?


Wonko

[MedEvil]

Wonko, the drivers neighter care for group dependency nor for start parameter. If they would, the driver would need to get started to find out, if it should be started.
Those parameters are for the kernel to know when to load which driver.
Once the driver get's loaded, it will look into the hardcoded key for its parameters, that you've got right.
But unless, there are also some special settings required, this does not matter.

[erwan.l]

Hello Gents,

Just a quick update, I took a look at the following deviceio controlcode : FSCTL_GET_VOLUME_BITMAP and added a new feature to CloneDisk, ie, the ability to save and restore only the used clusters on a logical NTFS drive (FAT32 should be possible in the future).

This is very similar to what ODIN does.

For a logical drive it will create 2 files : xxx.vol (the actual used clusters) and xxx.vol.cat (the "bitmap" file).

This could speed up the process of backuping / restoring a logical drive.



Regards,
Erwan.

[Wonko the Sane]

I hope that "bitmap" in your post is a translation from French for "sectors-map", and not what it seems in English...

.... a (possibly nice) picture.
http://www.thefreedi...nary.com/bitmap


Nice feature added!

Keep up the good work.


Wonko

[erwan.l]

Hi Wonko,

I felt unconfortable when writing the post using that word
More explanations there : http://msdn.microsof.....v=VS.85).aspx .

Quoting MS "Retrieves a bitmap of occupied and available clusters on a volume." .

Bitmap as map of bits I guess

Regards,
Erwan.

[maanu]

cross linking the thread here ,

http://www.boot-land...showtopic=11434

[Wonko the Sane]

@erwan.l
Unless I am mistaken, clonedisk has a RAW->VHD conversion but not a VHD->RAW option.

Such a feature may become handy.

Reason:
http://www.boot-land...?...8168&st=225
http://www.boot-land...?...8168&st=226
and:
http://www.boot-land...?...8168&st=237



Wonko

[erwan.l]

@erwan.l
Unless I am mistaken, clonedisk has a RAW->VHD conversion but not a VHD->RAW option.

Such a feature may become handy.

Reason:
http://www.boot-land...?...8168&st=225
http://www.boot-land...?...8168&st=226
and:
http://www.boot-land...?...8168&st=237



Wonko

Hi Wonko,
I could easily implement indeed (actually doing it as we speak) : it is as easy as to remove the header and eventually the footer.

This would work only on fixed vhd (fow now).

Regards,
Erwan.

[erwan.l]

Latest version can now turn a VHD (fixed hard disk only for now) into a raw image file.

/Erwan

[Wonko the Sane]

Latest version can now turn a VHD (fixed hard disk only for now) into a raw image file.

Wonko

[erwan.l]

Latest version can also convert dynamic VHD.

This is a beta for now : the file seems to be dumped fine, I can open it in winhex, browse my partition, open files, etc but I cannot open it imdisk or winimage : file system is not recognized.

My mbr seems fine, so does my boot sector...

A dynamic VHD works as follows :
-the guest disk is split into 2mb blocks
-before each block there is a 512 bytes bitmap : each bit of each byte (4096) is the offset of a sector within the block. bit 1 means sector is used, bit 0 means it is not.

So it was rather easy to go thru these bits and bytes to dump a raw image.

One question thus and this is maybe where my problem is : a dynamic can contain a larger file system.
When I dump my raw image, should it be the size be the logical one as seen within the VHD or the actual one i.e the used blocks only?
If it should be the logical size as I believe, should pad extra bytes somewhere/somehow to match the MBR and BS?

Any help welcome

Regards,
Erwan.

[Wonko the Sane]

Well, IMDISK cannot possibly work AFAIK, as well as most "drivers".

Winimage does have some quirks, expecially if the image has a MBR.

Of the "non-mounting" or "non-drivers" tools around have you tried with 7-zip?

Since the original "dynamic disk" is a somehow "sparse" file, you should re-store the converted RAW as a sparse file too.
(of course ONLY allowed on NTFS and NOT on FAT12/16/32/64)

JFYI, maybe useful (includes source):
http://www.boot-land...showtopic=11617
http://www.boot-land...?...=3191&st=42


Wonko

[erwan.l]

Well, IMDISK cannot possibly work AFAIK, as well as most "drivers".

Winimage does have some quirks, expecially if the image has a MBR.

Of the "non-mounting" or "non-drivers" tools around have you tried with 7-zip?

Since the original "dynamic disk" is a somehow "sparse" file, you should re-store the converted RAW as a sparse file too.
(of course ONLY allowed on NTFS and NOT on FAT12/16/32/64)

JFYI, maybe useful (includes source):
http://www.boot-land...showtopic=11617
http://www.boot-land...?...=3191&st=42


Wonko

I gave a call to 7zip: it opens some of my img files (which I know are correct) but show only partial content.
It does not open my vhd dynamic dump.

I gave a try to vdk : same as imdisk, it silenty mount the file but drive letter is unreadable.
But this time the type (07) is correct whereas imdisk reports a type 06.
Also I have compared the 300 first kb of my new image compared to dump of my vhd (from within the vhd) and they are identical so I am sure my MBR and BS are correct.
I need to check my MFT as thats the only that could prevent winimage and imdisk to load my image I guess.

D:\downloads\vdk32-050406>vdk open 1 g:\w2k3.vhd.img
Virtual Disk Driver for Windows version 3.1
http://chitchat.at.i...k.co.jp/vmware/

Failed to decide type of 'g:\w2k3.vhd.img'.
Open as a simple sector image file.
Virtual Disk 1
Access Type : Read-Only
Disk Capacity : 4194304 sectors (2048 MB)
Geometry : © 2048 * (H) 64 * (S) 32
Number Of Files : 1

Type Size Path
------- ------- ----
FLAT 4194304 g:\w2k3.vhd.img

Partitions :
# Start Sector Length in sectors Type
-- ------------ --------------------- ----
0 0 4194304 ( 2048 MB) <disk>
H: 1 63 4185153 ( 2043 MB) 07h:HPFS/NTFS

mbrbatch shows a correct MBR

/Erwan

edit : imdisk always change the partition type, even on working images. strange...

[Wonko the Sane]

You need maybe a .pln descriptor to describe the geometry:
http://www.boot-land...?showtopic=5505
http://www.forensicf...m...sc&start=42


Wonko

[erwan.l]

Got it, this was a bug in my logic... unallocated 2mb blocks also needed to be dumped to the raw image (filled with 0's).

So the dumped image (full disk image, i.e mbr+partition(s)) now can be mounted in all softwares like imdisk, vdk, etc ...

Regards,
Erwan

[Wonko the Sane]

Got it, this was a bug in my logic... unallocated 2mb blocks also needed to be dumped to the raw image (filled with 0's).

So the dumped image (full disk image, i.e mbr+partition(s)) now can be mounted in all softwares like imdisk, vdk, etc ...

Good , but if I get it right, this way you are "expanding" the converted image to it's maximum "dynamic" size.
On the contrary, you should create a "sparse" file, where trailing 00's sectors take no space.


Wonko

[Lancelot]

Hi erwan.l,

I am one of a silent reader of current topic, trying to learn things following informations on your development way of clonedisk....

converting vhd image from WindowsXPMode_zh-cn.exe (.vhd extracted out from .exe) to .img results with a very biig .img file during operation, in the end shrinks to 3.00GB.
i could not open this .img file with winimage (8.0.8000 , probably old now) or with imdisk (==>I am sure i am missing sth , maybe imageoffset etc. truely i have not start self training on these stuff much and not much time these days)

my initial trial for convert operation was on a disk with 20gb free space, ended with clonedisk "writefile error:112", at this point there were was no option but only to click ok and ok and ok....., so taskkilled..... maybe for such condition having an abort option with deletion of unfinished extraction can be a fine thingy or what ever you decide.... (+there are no abort option after conversion started)
edit: + if one uses clonezilla systemdrive with some freespace but not enough, it *may not be desirable to fill all space for our bad os windows which may* start responding sloww.

further, during operation, since it took long, clonedisk inside gui disappeared (title remains, I mean ingredient (=tabs, file-tools selections)), with disappeared i mean turn to white/gray. http://img441.images...00612142244.png . I know from my experiences of some other tools this is not important and i wait until operations finishes, but may cause misunderstanding for some others.

This is what i can do to support with my limited knowledge for now, Thanks a lot for all

edit:

[erwan.l]

Hi Lancelot,

I will add a stop option in all tabs so that you can stop the process anytime.
edit : done

I will also add clear text error message instead of obscure numberes (112=insufficient disk space by the way).
edit : done

I will also check the destination to be sure the to be created image can fit.
edit : clonedisk will ask you if you actually want to dump a xxx mb file (up to you to check the destination drive)

I will also check that the input file is correct before I start processing it.
edit : done

Thanks for your feedback, the only way to really improve

Regards,
Erwan

[MedEvil]

Does 'done' mean, new version available?
If so, it would be nice, if you would give next time the version number too.

[erwan.l]

Does 'done' mean, new version available?
If so, it would be nice, if you would give next time the version number too.

Hi Indeed,
Done and uploaded.
New version 1.6.7.

I need to be more thorough in versioning indeed

I am dirty coder and tend to drop versioning and documentation...

Regards,
Erwan.

[MedEvil]

Thanks!