Tags


I came across an interesting issue with a Kingston DataTraveler Micro USB Flash Drive yesterday that I thought worth sharing.

Initially, I spotted an error in the System Event Log – “{Delayed Write Failed} Windows was unable to save all the data for the file … The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.”  Since I hadn’t been yanking USB drives out without formally ejecting them, this was a little concerning.  Here’s the full error:

usb-1-delayedwrite

A scroll through the System Event Log was less than reassuring, with many errors with Source disk and Ntfs:

usb-2-systemlog

The error from source disk was “An error was detected on device \Device\Harddisk2\DR7 during a paging operation.”  It’s not immediately clear how to tally “\Device\Harddisk2\DR7” to a physical drive in the PC:

usb-3-diskerror

The error from source Ntfs was “The system failed to flush data to the transaction log.  Corruption may occur in VolumeId: E:, DeviceName: \Device\HarddiskVolume11. (The I/O device reported an I/O error.)”  That’s a more helpful error as it gives a drive letter that corresponded to one of my USB Flash Drives:

usb-4-ntfserror

On opening the Disk Management MMC, it can be seen that the Disk number shown on the left side of the GUI that holds the partition bearing this E: drive matches the Harddisk number (2) in the disk event log entry.  So the two errors match up:

usb-5-diskmanagement

My first thought was to try to scan the drive for any errors and fix them.  The computer then bizarrely claimed that “The disk is write protected.”  This is not the sort of USB Drive that has a physical write-protect switch:

usb-6-writeprotected

I then wondered if my AntiVirus was interfering, so I tried disabling both it and my AntiExploit software but to no avail.  After some reading around, I discovered that diskpart can be used to view and alter the Read-Only status of a drive via its detail disk command.  I first use list disk to find the ID of the drive (by looking at the Size of the disks) and then I use select disk to set the focus to that drive.  Note that the results include the arrowed lines “Current Read-only State : Yes” and “Read-only : No”:

usb-7-diskpart1

I had seen examples online where both attributes were set to “Yes” and the recommended fix was to try the command attrib disk clear readonly.  I tried it anyway but it made no difference, with the attributes appearing the same afterwards:

usb-7-diskpart2

There were also references online on this subject to registry key HKEY_LOCAL_Machine\System\CurrentControlSet\Control\StorageDevicePolicies having a DWORD value WriteProtect that needed changing from 1 to 0.  I didn’t have this key or value on my system.  I then suspected this was almost certainly a hardware failure of some sort and then confirmed the drive did not work on a different computer.

More Googleage revealed what had happened.  It appears to be a deliberate feature in the drive firmware that when it detects that the drive is having problems, it becomes permanently write-protected to protect the data on there from further loss.

I contacted Kingston and the end result is that the drive is being replaced under warranty.  I would like to add that this is the second dealing I’ve had with Kingston’s technical support (a different reason previously) and I have found them outstanding both times!

Advertisements