±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36006
New Yesterday: 0 Visitors: 134

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

safely removing external HDD fails due to System $extend.

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

williamsonn
Senior Member
 

safely removing external HDD fails due to System $extend.

Post Posted: Apr 01, 13 01:05

Hello

I am asking advice about this subject here as no common computing expert waas able to answer me regarding this question: I have an external HDD containing a truecrypt , encrypted folder. When I mount the HDD, and dismount it the HDD can´t be stopped. The software USB safel remove says that it can´t be stopped due to D: $Extend.... It is the same case as explained here:

superuser.com/question...ely-remove


What should I do? I wouldn´t like to damage the disk nor the data contained in it.


Please, my level of knowledge is near zero, so, please, try to explain it in an easy way.

Thank you very much for your help.  
 
  

Belkasoft
Senior Member
 

Re: safely removing external HDD fails due to System $extend

Post Posted: Apr 01, 13 13:41

What is the purpose of dismounting the disk? Is it your own (or office) hard drive, or a disk filled with evidence?

If it's your own disk, I would recommend dismounting it by followint these instructions (they describe how to remove the drive letter, after which the disk will become unlocked):
windows.microsoft.com/...nt-a-drive

If the disk contains evidence, it's better to simply shut it down the hard way.
_________________
Computer, Mobile, RAM and Cloud Forensics In a Single Tool
belkasoft.com 
 
  

jaclaz
Senior Member
 

Re: safely removing external HDD fails due to System $extend.

Post Posted: Apr 01, 13 15:11

- williamsonn
It is the same case as explained here:

superuser.com/question...ely-remove


What should I do? I wouldn´t like to damage the disk nor the data contained in it.

It should be connected with write cache, see:

www.sevenforums.com/ha...ect-2.html
safelyremove.com/forum...&t=129

By enabling Write cache, you should be able to "flush" changes when clicking on "safely remove" and thus "unlock" any connection to the \$Extend\ .
BUT you will have to always use the "Safely remove hardware".

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

williamsonn
Senior Member
 

Re: safely removing external HDD fails due to System $extend

Post Posted: Apr 07, 13 05:59

Dear Belkasoft and Jaclaz. Thanks for your answers.

Belkasoft: It is my own HDD.

jaclaz: Do yo mean that I have to enable Write Cache in each PC I will plug the HDD on, and also to always use the software USB Safely remove, and so the HDD will always be safely and correcly removed? Are both methods(the one mentioned by Belkasoft and yours) similarly valid for this particular purpose?

Thank you both very much Smile  
 
  

jaclaz
Senior Member
 

Re: safely removing external HDD fails due to System $extend

Post Posted: Apr 07, 13 20:37

- williamsonn

jaclaz: Do yo mean that I have to enable Write Cache in each PC I will plug the HDD on, and also to always use the software USB Safely remove, and so the HDD will always be safely and correcly removed?

No, I don' t mean that, it seems like it is not a "generic" issue, surely it doesn't happen on *all* OS/installs, simply your mileage may vary.

- williamsonn

Are both methods(the one mentioned by Belkasoft and yours) similarly valid for this particular purpose?

Of course no, at least myself simply love to provide senseless and unuseful info. Shocked
Just try them. Wink
Chose the one you like better/works better for you.

Following Belkasoft's suggestion, it might be easier/more practical to use Mountvol /D:
ss64.com/nt/mountvol.html

...or try RemoveDrive:
www.codeproject.com/Ar...fe-Removal
www.uwe-sieber.de/drivetools_e.html
or EjectMEdia, as above and here:
www.codeproject.com/Ar...cache-lock

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

williamsonn
Senior Member
 

Re: safely removing external HDD fails due to System $extend

Post Posted: Jun 03, 13 02:53

I have tried enabling and disabling write cache and quich removal. Nothing works.

The disc is a 500GB Seagate containing truecrypt encrypted folders. The fault is only when I write on the disc or mount the encrypted volumes on the disc but not if I only plug the disc and see its contents. This failure is only in Vista and W7, not in XP.

The computer with Vista or 7 don´t recognize the disc as removable.

1- I have not tried with unocker otr safely remove softwares the option "kill the process".(I rember you that process is identified by Safely Remove as System $Extend, etc) Will cause any damage to the disc if I try "kill this prcess?


2-If that doesn´t work: What is the way I should follow in order to safely eject the disc, without damaging it? (You told me some other options but my level of knowledge doesn´t allow me to understand them properly) Is there any software which can do it, or is there in task manager any process I could manually stop without damaging Windows, but allowing to safely stop the disc?

thanks  
 
  

williamsonn
Senior Member
 

Re: safely removing external HDD fails due to System $extend

Post Posted: Jun 03, 13 03:07

3rd question

I have read on internet that if nothing works for properly ejecting external storage media, you can safely remove them by simply shutting down PC. Is this true? If so, this is made through a command on cmd or simply is made by turning off usually the computer button with the mouse?  
 

Page 1 of 2
Page 1, 2  Next