|
| |
General |
An USB pen drive (also called 'flash drive', 'memory stick' or in german 'USB-Stick') is drive and media in one. Therefore the drive letter comes and goes with it.
In contrast a card reader stays attached and only the card is plugged and unplugged, so the drive letters stay.
Because it's drive and media in one, each time you plug a pen drive for the first time the Windows
plug'n play starts up a assigns the first available drive letter. When the USB has no USB serial then this happens again if it's attached to a different USB port.
To get rid of the 'first free letter assignment' I wrote the USB Drive Letter Manager which works under Windows 2000, XP and higher.
|
|
| |
|
| |
How XP assigns drive letters |
For a drive which XP has no drive letter assignment stored it assigns the first available drive letter. The search goes upwards in the alphabet and starts at 'A' for floppy drives, at 'D' for CD-ROM drives and at 'C' for all other types.
XP can save exactly one assignment per drive letter. So when a drive is attached again it gets the same letter as before. But the drive letter is not reserved while a drive is not present and therefore reassigned to another drive if required. When this happens the former assignment is overwritten and the first drive gets the first available drive letter again even its former drive letter is available when it's being attached. The former assignment just doesn't exist anymore.
Network and substs drives are completely unconsidered by XP here. XP has no problem assigning a drive to letter which is currently used as network share! Microsoft knows that this is
'a problem' and since December 2007 a hotfix is available (WindowsXP-KB297694-x86-ENU.exe). The Service Pack 3 will fix it too.
To get persistent drive letters for external drives assign one exclusive letter per drive.
My USB Drive Letter Manager solves all this.
|
|
| |
|
| |
Removable or what? |
USB drives can appear as 'Removable Drive' or as 'Local Drive'. The actual meaning of 'removable' is that the drive has a removable media, like floppy and ZIP drives or flash card readers.
Even USB pen drives have no removable media they pretend to have by having the removable media bit (RMB) set in their hardware device descriptor. Strictly spoken this is just wrong but in fact nearly all USB flash drives have the RMB set while USB hard disks have not.
Appearing as removable or local drive makes a difference under Windows. Here the differences for XP SP1 and SP2:
|
Removable Drive
|
Local Drive
|
GetDriveType returns
|
DRIVE_REMOVABLE
|
DRIVE_FIXED
|
more than one partition/volume possible
|
no
|
yes
|
autorun.inf - open= works
|
no
|
yes (until XP-SP1)
|
'Eject' in Explorer's context menu
|
yes
|
no
|
Windows activates system restore for the drive and creates folder 'System Volume Information'
|
no
|
yes
|
Formatting with NTFS with policy 'Optimize for quick removal'
|
no
|
yes
|
| Formatting with NTFS with policy 'Optimize for performance' |
yes
|
yes
|
| write cache active on FAT and policy 'Optimize for quick removal' |
no
|
no
|
| write cache active on FAT and policy 'Optimize for performance' |
no
|
yes
|
| write cache active on NTFS and policy 'Optimize for quick removal' |
yes
|
yes
|
| write cache active on NTFS and policy 'Optimize for performance' |
yes
|
yes
|
Because of the ability to create multiple partitions on a non removable drive and getting a write cache under XP, some users are searching for pen drives which do not pretend to have a removable media. They are extremely rare, no major brands are available. But it's possible to turn a 'removable' drive into a 'fixed' one by a filter driver,
see here.
|
|
| |
|
| |
Cache or not |
Under Windows XP writing of lots of small files to a 'Removable' pen drive is extremely slow, while it's fast under Windows 2000. Writing large files there is no appreciable difference.
Obviously Windows XP doesn't enable a write cache for USB drives that appear as 'Removable'. The settings 'Optimize for quick removal' or 'Optimize for performance' doesn't seem to make any difference then, except that the latter enables the user to format 'Removable' USB drives with NTFS. But with NTFS Windows XP enables a write cache, writing small files becomes lightning fast.
But actually NTFS isn't suitable for flash medias because as journalling file system it has some overhead that wears out flash memory. But Windows XP optimizes and bundles write accesses to pen drives only when they are NTFS formatted, so I see NTFS as the right choice.
Furthermore NTFS stores small files together with the file information so they are written into the same flash block which is the best that can happen.
A drawback with NTFS and flash medias is that NTFS saves the access time when you read a file, so a simple read access causes flash wear out. In fact it is not as dramatically because Windows writes the data not immediately onto the media. It does it when it has to update something else there, when one hour is over on when a media is unmounted. Actually I've never seen XP writing a last access time to an USB drive.
The last access time is also updated on 'directory listing' (whatever this means).
This can be disabled, unfortunately for all drives only:
Create a new DWord value under [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] called
NtfsDisableLastAccessUpdate and set it to 1. Or download the following REG file and doubleclick it:
NtfsDisableLastAccessUpdate1.reg
Information:
NtfsDisableLastAccessUpdate at Microsoft Technet
To format a pen drive with NTFS there is no need to switch to 'optimize for speed'. Using the commandline tool CONVERT you can convert a FAT formatted drive to NTFS. Sample:
convert u: /fs:ntfs
But XP's CONVERT creates a NTFS with a cluster size of 512 Bytes when the FAT clusters are not 4K aligned. If the drive is FAT formatted under XP, then the clusers are 4K aligned and XP's CONVERT works fine. W2K's CONVERT seems to creates 512 Bytes clusters in any case.
Using the Windows format dialog you can choose: 2048 or 4096 Bytes are ok. With a cluster size above 4096 Bytes file compression and encryption becomes unavailable.
Of course a NTFS formatted drive doesn't work under Windows 95/98/ME. Furthermore devices with a standalone functionality as MP3 players or image tanks will not work with NTFS.
The effect of having a write cache or not depends on the USB drive: Hard drives have an 2 or 8 MB of cache RAM which prevents to much performance impact. Today's USB flash have no such cache, so their access times are very important for their real live speed.
By means of HD Tune you can check the read access times. Here a screenshot of the bad example 'Corsair Flash Voyager' (2GB) - have a look at the yellow dots above the diagram...
It's from 2005, the current exemplars are better.
To test the file cache behaviour I've made FileCacheTest
It can read and write a test file using different flags for the API function CreateFile and using different block sizes. Remember the difference between writing a file for the first time and to an existing file: Writing the first time, the file size has to be adjusted after each block.
The most remarkable effects under XP are:
- no buffering of accesses to the file system on FAT formatted removable USB drives
- writing to FAT formatted removable USB drives using a block size below 4096 Bytes is cached, others are not
- using flag FILE_FLAG_RANDOM_ACCESS causes a blows up of the file cache's working set
- using flag FILE_FLAG_NO_BUFFERING is the most efficient way to read and write large files
- for 'removable' USB drives the removal policies 'Optimize for speed' and 'Optimize for quick removal' have absolutely no effect on the cache's behaviour
| |
| |
|
| |
Safe removal |
An USB drive should never be removed without logging it off, especially when the drive has a write cache. The official way is thru a symbol in the systray and some mouse clicks.
For 'removable' drives as internal card readers the media should be 'ejected': Right click the drive in the Windows Explorer, select 'Eject' here. Under XP this is not allowed for restricted users but this can be enabled by a policy.
There are some useful commandline tools for this purpose but they all have some disadvantages. So I wrote my own:
Reactivate an USB drive
When a drive has been prepared for safe removal then it can be reactivated only by replugging it.
Alternatively the device could be deactivated and later reactivated instead being prepared for save removal. This can be done by means of Microsoft's command line tool DEVCON like this:
devcon disable USB\VID_067B*PID_2517*
devcon enable USB\VID_067B*PID_2517*
You can determine the device ID by means of my ListUsbDrives (the 'Ctrl DevID').
The & has a special meaning on the XP command line, so replacing it by * (placeholder for any characters) is an easy way to prevent problems.
Drawback: Once deactivated the device must be reactivated before it works again, replugging is not enough!
Solution: Put an USB hub before the device in question. If the hub is deactivated and reactivated then all there attached devices wakes up even if they had been prepared for safe removal. The hub's device ID is shown too by my ListUsbDrives when stared with -A (as all info), it's the 'Ctrl2 DevID'.
| |
| |
|
| |
My Tools for USB drives |
Developing USBDLM I've made some other tools. They got their own page:
Drive Tools for Windows
| |
| |
|
| |
Automatic actions on plug in and out |
My USB drive letter manager can execute AutoRun events on arrival of a drive, on removal request and after removal.
Automatic actions on arrival of an USB drive can be easily abused to copy interesting data from it in the background. So, never, never attach an USB drive with sensible data to a foreign computer even if you stand beside all the time! It's very easy to copy all DOC, XLS and PDF files in the background!
| |
| |
|
| |
USB drive as trojan horse |
Have a look at a found USB pen drive - who can resist...
With a normal pen drive there is a danger only under Windows 2000. Since XP the line open= in the autorun.inf file is no more executed by windows. But XP does it on CD-ROM drives! Therefore these U3 flash drives use a fake CD-ROM drive on their pen drives which launches the 'U3 launchpad' automatically. But the contents of the CD-ROM can be easily changed into malware!.
So, whenever you attach a foreign USB drive, hold down the Shift key to skip AutoRun. Or completely deactivate AutoRun by means of my tool AutoRunSettings
Microsoft's TweakUI is buggy here. It completely ignores the default values, so once used, AutoRun for unknown and network drives gets activated!
But there are more dangerous mechanisms, see here:
How to: Quick intro to hacking autorun for USB flash drives
In August 2008 Microsoft finally recognized that there is a security problem and offers updates which apply the autorun settings to the manual actions too, see here:
http://support.microsoft.com/kb/953252
| |
| |
|
| |
Pen drive under Windows 98 and NT4 |
For MS-DOS there is a lot of USB stuff. This page gives a good summary:
USB DOS Ressources
This one too:
USB Bootdisk
For Windows 98 you get drivers with the drive. If not you can try to use a driver of a foreign drive. Here is a german howto:
http://www.techwriter.de/beispiel/usb-mem2.htm
From COS Memory there are drivers which can be adopted in the same way:
http://www.cos-memory.de/downloads/treiberdownload.htm
Meanwhile there is an universal driver package for USB drives:
http://www.technical-assistance.co.uk/kb/usbmsd98.php
It uses Windows 2000 files, so you should have an additional valid Windows 2000 licence when you use this package...
Windows NT4 got no USB support by Microsoft - we shall buy a new system from time to time... Other vendors help:
-
USB driver by Inside Out Networks for Dell Latitude Laptop (doesn't work with USB hubs. Using an additional package by Inside Out Networks you can add hub support (link doesn't work anymore):
ip4n4260.exe
There seems to be no read or write cache with NT4, so pen drives behaves very slow here.
-
From Digi International there is a driver package for an USB camera which shall include a driver for USB mass storage. I havn't tested it.
http://ftp1.digi.com/support/driver/i4usb403.exe
-
From China comes another USB driver for NT4 which supports USB 2.0 highspeed. I've made a short test: On a NForce2 board it hangs sometimes but I think that's a NForce2 problem. On several other machines it worked fine and fast. Read and write cache is active. The only drawback is that it assigns always drive letter Z: even according to the homepage this should be fixed. You can change this with the disk manager but on next reboot it's again Z:.
Woodhead's Home
| |
| |
|
| |
Encrypt an USB drive |
All encryption solutions which work thru an encrypted drive with drive letter have on thing in common: Administrator privileges are required, at least once to install the ecryption software. This is a problem on foreign computers.
When a guest wants to install his encryption software, he must been trusted unconditional because he is granted to execute his software with administrator privileges. But no one can be sure what this software does despite the encrytion job. The computer is just compromised then!
Even an antivirus software is useless because the foreign software is executed with admin privileges an the user will grant all requests to make it work.
NTFS encryption is no help too because dealing with certificates is no fun and they are not compatible between Windows 2000 and XP.
Solution: The approved open source software TrueCrypt:
http://www.truecrypt.org
It requires admin previlegs too but only once for installation. And the admin can download the software itself and validate its integrity by checking its PGP signature.
Using TrueCrypt is documented on countless pages in the internet, just enter TrueCrypt at your preferred search engine.
| |
| |
|
Counter since Feb. 1998
last change: 13 December 2008
Uwe Sieber
Back |
This page is available in German language too