none
Corrupted files on unprotected volume

    Question

  • Hi I have a system setup with HORM and EWF

    I have the OS Partition (C:) protected by EWF

    I have a Data Partition (D:) not protected.

    I have coded the hibernation in my Application

    I also lock & dismount the volume (D:) before hibernating

    I attempt to unlock the volume on resume (ignoring the error return from the command, since the OS unlocks the volume before I do)

    I resume the device and use my app to create some date on drive D: and then logoff.

    When I come back I don't see the data, it varies from boot to boot, doing a checkdisk on d drive shows data corruption.

    What am I doing wrong?

     

    EWF OUTPUT & DISK PART INFO LISTED BELOW
    =================================

    Protected Volume Configuration
      Type            RAM
      State           ENABLED
      Boot Command    NO_CMD
        Param1        0
        Param2        0
      Persistent Data ""
      Volume ID       A3 04 2D A4 00 00 10 00 00 00 00 00 00 00 00 00
      Volume Name     "\\?\GLOBALROOT\Device\HarddiskVolume1" [C:]
      Max Levels      1
      Clump Size      512
      Current Level   1

      Memory used for data 28651520 bytes
      Memory used for mapping 16384 bytes

    The Ewf Volume is "\Device\HarddiskVolume2"
    Ewf Volume Configuration
      Volume Size            36352
      Segments               0
      Segment Size           0
      Free segments          0
      Max Levels             1
      Max Protected Volumes  1
      Protected Volumes      1

    Protected volumes
      Volume Name     "\\?\GLOBALROOT\Device\HarddiskVolume1" [C:]
      HORM        Active

    ==================================

    DISKPART

    List Disk

    Disk 0 Online 149 GB FREE 0B

    LIST PART

    Partition ### Type            Size     Offset

    Partition   1    Primary       9GB       1024KB
    Partition   0    Extended    34GB      9GB
    Partition   3    Logical        35KB      9GB
    Partition   4    Logical        34GB      9GB
    Partition   2    Primary       105GB    43GB

     

    Here is my unmounting / mounting code

    BOOL CDesktopDlg::HandleDataDriveVolumeMountingAndLocking(BOOL bDismountAndLock)
    
    {
    
    	BOOL bRetVal = FALSE;
    
    
    
    	// To create an unprotected volume in a Hibernate Once/Resume Many environment, 
    
     // you must lock and dismount the volume before you create the hibernation file.
    
    	// To lock and dismount a volume, you must create an application that calls the DeviceIoControl function. 
    
     // This function sends control codes directly to the file system. 
    
     // By passing the parameters FSCTL_LOCK_VOLUME and FSCTL_DISMOUNT_VOLUME to the function, 
    
     // you can lock and dismount the volume before the hibernation file is created. 
    
    
    
     // http://www.windowsfordevices.com/c/a/Windows-For-Devices-Articles/What-is-HORM-and-how-can-you-use-it/ 
    
    
    
     HANDLE hDevice = NULL;
    
    	CString szDrive = _T("\\\\.\\d:");
    
     hDevice = CreateFile(szDrive,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ | FILE_SHARE_WRITE,NULL,OPEN_EXISTING,
    
    						 FILE_FLAG_NO_BUFFERING,NULL);
    
     if (hDevice != INVALID_HANDLE_VALUE)
    
    	{
    
    		DWORD cbReturned = NULL;
    
    		if( bDismountAndLock)
    
    		{
    
    			if( DeviceIoControl(hDevice,FSCTL_LOCK_VOLUME,NULL,0,NULL,0,&cbReturned,NULL))
    
    			{
    
    				MessageBox(_T("LOCK VOLUME SUCCESSFULL"));
    
    				// If we locked the volume 
    
        cbReturned=0;
    
    				if ( DeviceIoControl(hDevice, FSCTL_DISMOUNT_VOLUME, NULL, 0, NULL, 0, &cbReturned, NULL) )
    
    				{
    
    					MessageBox(_T("DISMOUNT SUCCESSFULL"));
    
    					bRetVal = TRUE;
    
    				}
    
    				else
    
    				{
    
    					MessageBox(_T("DISMOUNT FAILED"));
    
    				}
    
    			}
    
    			else
    
    			{
    
    				MessageBox(_T("LOCK VOLUME FAILED"));
    
    			}
    
    		}
    
    		else
    
    		{
    
       cbReturned=0;
    
    			if( DeviceIoControl(hDevice,FSCTL_UNLOCK_VOLUME,NULL,0,NULL,0,&cbReturned,NULL))
    
    			{
    
    					MessageBox(_T("UNLOCK SUCCESSFULL"));
    
    					bRetVal = TRUE;
    
    			}
    
    			else
    
    			{
    
       int lastError = GetLastError();
    
       if (lastError == ERROR_SUCCESS || lastError == ERROR_NOT_LOCKED)
    
       {
    
        // The system may have unlocked the volume so ignore that specific error.
    
        // “The operating system tries to mount an unmounted volume as soon as an attempt is made to access it. 
    
        // For example, a call to GetLogicalDrives triggers the operating system to mount unmounted volumes” (MSDN documentation for FSCTL_DISMOUNT_VOLUME)
    
       }
    
       else
    
       {
    
    
    
        CString szMessage;
    
        szMessage.Format(_T("UNLOCK VOLUME FAILED: Error %ld\n"),lastError);
    
        NPAssert(__FILE__, __LINE__, __TIMESTAMP__, szMessage, EVENTLOG_WARNING_TYPE );
    
        bRetVal = FALSE;
    
    
    
       }
    
    			}
    
    		}
    
    		CloseHandle(hDevice); 		 		
    
    	}
    
    	else
    
    	{
    
    		CString szMessage;
    
    		szMessage.Format(_T("Failed opening the target device %s with error %ld\n"),szDrive, GetLastError() );		  
    
    		Mes
    • Edited by ASoftDeveloper Tuesday, March 22, 2011 9:38 PM Added mounting/unmounting code
    Tuesday, March 22, 2011 9:28 PM