Jump to content











Photo
- - - - -

USB-Stick mounted as Fixed Or as Removable

usb fixed removable windows 10

  • Please log in to reply
34 replies to this topic

#26 wimb

wimb

    Platinum Member

  • Developer
  • 2626 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 2 weeks ago

And what is the contents of the MountedDevices now?

 

 

MountedDev-New-2019-08-09_110927.png == MountedDev-New-Q-2019-08-09_111034.png

 

Attached File  UUID_MountedDev_New.txt   1.29KB   13 downloads

 

I returned from the clean system to the previous system where the experiments were done.

Thanks to VHD WIMBOOT I can easily create a Clean System and switch between systems.  :)

 

To answer your question:

The volume guids are created new, but the guid used to identify drive Q: is still the same with the strange node ....

 

==============================================================================

 

New Experiment on Clean System

 

There is something else that I noticed on Clean System:

On repartitioning other USB-Stick marked U2, when you have removed all partitions,

then in Disk Management the Drive letter is strangely parked at the box where the Drive number (in my case Schijf 5) is presented.

So in some way the drive letter is preserved. Second partition gets this letter P:  and has the Removable ID. First partition gets free letter Q:

 

This time the Stick remains registered as Removable

 

DevMan_Letter-2019-08-09_134905.png == DevMan_Letter-2019-08-09_135447.png

 

MountedDev_U2_2019-08-09_135938.png == DosDev_Q_U2-2019-08-09_140042.png

 

Attached File  UUID_MountedDev_U2.txt   1.29KB   13 downloads

 

All the UUID's have now the strange node:  32:52:cb:53:65:9d

 

This is almost my WLAN node



#27 Olof Lagerkvist

Olof Lagerkvist

    Gold Member

  • Developer
  • 1415 posts
  • Location:Borås, Sweden
  •  
    Sweden

Posted 2 weeks ago

Semi-unrelated sidenote:

 

I have seen a few other differences between how Windows handles removable vs fixed, even though all partitions are recognized in latest versions. For example shadow copies seems to be accessible only if the device is detected as fixed. From what I recall now from some experiments with that, the volsnap driver did not even attach to the device stack at all for removable devices.



#28 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 14919 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 2 weeks ago

To answer your question:

The volume guids are created new, but the guid used to identify drive Q: is still the same with the strange node ....

 

Well this should mean that that UUID is stored somewhere else besides in "MountedDevices" (likely some other key in the Registry).

Finding in which key in the Registry it is would probably bring some more insight.

I am thinking of something *like* (good :dubbio:) ol'  MountPoints2 key:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

 

:duff:

Wonko



#29 wimb

wimb

    Platinum Member

  • Developer
  • 2626 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 2 weeks ago

Thanks Olof for Interesting Info  :)

 

 

Well this should mean that that UUID is stored somewhere else besides in "MountedDevices" (likely some other key in the Registry).

Finding in which key in the Registry it is would probably bring some more insight.

I am thinking of something *like* (good :dubbio:) ol'  MountPoints2 key:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

 

 

Such key is not in the registry.

 

A search for 944d75b4-b74c-11e9-91f0-3252cb53659d gives a lot of hits, but the most interesting are

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Portable Devices\Devices\SWD#WPDBUSENUM#{944D75B4-B74C-11E9-91F0-3252CB53659D}#00000006D6100000

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceContainers\{d12328cc-72fc-5a54-ae9b-69940e57e520}\BaseContainers\{d12328cc-72fc-5a54-ae9b-69940e57e520}
STORAGE\Volume\{944d75b4-b74c-11e9-91f0-3252cb53659d}#00000006D6100000
SWD\WPDBUSENUM\{944d75b4-b74c-11e9-91f0-3252cb53659d}#00000006D6100000

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_\60A44C425294F27039868C15&0\Device Parameters\Partmgr
DiskID value {944d75b4-b74c-11e9-91f0-3252cb53659d}


#30 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 14919 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 2 weeks ago

Very interesting. :)

 

And I presume that the same keys are not in the "fixed" Registry, right?

 

Probably it is something connected to this:

https://docs.microso...vice-capability

https://docs.microso...vice-capability

https://docs.microso...bility-override

 

But as always whatever the good MS guys decide to document is either vague or not clear and missing meaningful examples/references.  :(

 

There is a related (indirect confirmation) that starting from Windows 7 the OS has an occasional difficulty to determine if a device is fixed or removable, but couldn't find anything actually explaining when/what/why it happens:

https://hatsoffsecur...he-volume-name/

 

In the meantime (not much progress) I realized, that though using different notation, both:

"\\DosDevices\\Q:"=hex:11,e3,11,e3,00,00,10,d6,06,00,00,00 (from the "fixed Registry") 

and the "The Q: value is actually a UUID: {944d75b4-b74c-11e9-91f0-3252cb53659d} followed by #00000006D6100000" (from the Remov Registry):

 

"\\DosDevices\\Q:"=hex:7b,00,39,00,34,00,34,00,64,00,37,00,35,00,62,00,34,00,\
2d,00,62,00,37,00,34,00,63,00,2d,00,31,00,31,00,65,00,39,00,2d,00,39,00,31,\
00,66,00,30,00,2d,00,33,00,32,00,35,00,32,00,63,00,62,00,35,00,33,00,36,00,\
35,00,39,00,64,00,7d,00,23,00,30,00,30,00,30,00,30,00,30,00,30,00,30,00,36,\
00,44,00,36,00,31,00,30,00,30,00,30,00,30,00,30,00

 

Are actually both 0x06D6100000, i.e. 29,361,176,576 i.e. the offset in bytes to the beginning of the partition.

 

:duff:

Wonko



#31 wimb

wimb

    Platinum Member

  • Developer
  • 2626 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 2 weeks ago

Thanks for interesting Info.

 

And I presume that the same keys are not in the "fixed" Registry, right?

 

 

It is more complicated.

 

When the USB-Stick is seen as Fixed drive, then the registry contains also that key 

 

A search for 944d75b4-b74c-11e9-91f0-3252cb53659d in the Fixed case registry gives a lot of hits, but the most interesting are

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Portable Devices\Devices\SWD#WPDBUSENUM#{944D75B4-B74C-11E9-91F0-3252CB53659D}#0000000000100000

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Portable Devices\Devices\SWD#WPDBUSENUM#{944D75B4-B74C-11E9-91F0-3252CB53659D}#00000006D6100000

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceContainers\{00000000-0000-0000-FFFF-FFFFFFFFFFFF}\BaseContainers\{00000000-0000-0000-FFFF-FFFFFFFFFFFF}
STORAGE\Volume\{944d75b4-b74c-11e9-91f0-3252cb53659d}#0000000000100000
STORAGE\Volume\{944d75b4-b74c-11e9-91f0-3252cb53659d}#00000006D6100000

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_\60A44C425294F27039868C15&0\Device Parameters\Partmgr
DiskId  value  {944d75b4-b74c-11e9-91f0-3252cb53659d}

MountedDevices has Volume with that UUID inside  :hyper:

 

MountedDev_Fixed-2019-08-10_075354.png  == MountedDev_Fixed_Vol_2019-08-10_075222.png

 

Attached File  UUID_MountedDev_Fixed.txt   1.71KB   9 downloads

 

When I remove manually the MountedDevices Volume entries and the entries for P: and Q:

Then after reboot and Reconnect the USB-Stick only the P: and Q: entries reappear and the USB-Stick is still seen as Fixed Drive

 

MountedDev_Fixed_Reset-2019-08-10_090026.png



#32 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 14919 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 2 weeks ago

Which should mean that it is "independent" from the "Container" stuff, but in the "fixed" you have BOTH:

 

STORAGE\Volume\{944d75b4-b74c-11e9-91f0-3252cb53659d}#0000000000100000 <- this is first patrtition aka P: offset 0x0100000
STORAGE\Volume\{944d75b4-b74c-11e9-91f0-3252cb53659d}#00000006D6100000 <- this is second partition aka Q: offset 0x06D6100000

 

BUT NOT:
SWD\WPDBUSENUM\{944d75b4-b74c-11e9-91f0-3252cb53659d}#00000006D6100000

 

It is *like* the removable only "sensed" the Q: volume (and made *some* changes that make the P: volume use the "normal" _??_USBSTOR#Disk&Ven_ ) whilst the fixed "sensed" both volumes and set them in such a way that they revert to fixed and Disk Signature+offset (BUT still one of the two volumes has the "new" UUID+offset reference).

Or the opposite of the above. :w00t:

 

It could be some sort of timing problem, but still no idea on how the mechanism actually works (or completely fail to). :(

 

:duff:

Wonko



#33 wimb

wimb

    Platinum Member

  • Developer
  • 2626 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 2 weeks ago

Indeed still difficult to understand why the registry mounts the USB-Stick as a Fixed drive

 

But it is indeed remarkable that in the registry for the Fixed case there is not the entry

 

SWD\WPDBUSENUM\{944d75b4-b74c-11e9-91f0-3252cb53659d}#00000006D6100000



#34 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 14919 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 2 weeks ago

I am thinking of something *like* (good :dubbio:) ol'  MountPoints2 key:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

 

Such key is not in the registry. 

 

Oh yes, it is:

https://pdfs.semanti...3269a5329c2.pdf

 

:duff:

Wonko



#35 wimb

wimb

    Platinum Member

  • Developer
  • 2626 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 2 weeks ago

MountPoints2 does Not exist in HKEY_USERS\.DEFAULT\  ;) 

 

MountPoints2 does exist indeed in:

 

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

 

Computer\HKEY_USERS\S-1-5-21-459577182-2476619361-2338099180-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

 

But the UUID 944d75b4-b74c-11e9-91f0-3252cb53659d is not found in those keys







Also tagged with one or more of these keywords: usb, fixed, removable, windows 10

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users