[SOLVED] USBstick take letter D and not U I choose to assign U to the USBkey..
#41
Posted 23 April 2009 - 02:10 PM
Maybe there is another windows setting?
Does windows install files contain a ignore USB serial setting.
Hence new installed windows ignore MountedDevices?
migrate_XPproSp3.inf
\??\STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
migrate_Win2003.inf
\??\STORAGE#RemovableMedia#8&157ad62&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
RemovableMedia#8 is very seldom used.
Does this relate to hardware or windows?
If you boot windows at another machine, does windows use RemovableMedia#7 or RemovableMedia#8 for the USB stick?
@pipster
Can you install windows again?
Which MountedDevices goes to USB stick at new installed windows?
If new installed windows use RemovableMedia#7 then a adjusted migrate.inf should work.
@jaclaz
Uwe offers DriveCleanup to remove USB devices from registry.
http://www.uwe-siebe...ivetools_e.html
#42
Posted 23 April 2009 - 03:51 PM
jaclaz, on Apr 23 2009, 09:10 PM, said:
23rd October 2008 must have been a busy day.
I would try to disconnect all USB devices and delete all keys under:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\
Then try reconnecting one stick and see what happens.
Maybe something made the 7& being available and start with 8& and 9&....
jaclaz
Eheheh!
I have tested 3-4 mouses, and everyone coming here is plugging their usb stick.
I have 3 sticks, 1 external hd (dead some days ago with his 320gb of data
But is such a strange thing 95% of that have born on 23rd October 2008!!
cdob, on Apr 23 2009, 10:10 PM, said:
@pipster
Can you install windows again?
Which MountedDevices goes to USB stick at new installed windows?
If new installed windows use RemovableMedia#7 then a adjusted migrate.inf should work.
@jaclaz
Uwe offers DriveCleanup to remove USB devices from registry.
http://www.uwe-siebe...ivetools_e.html
Anyway I have Windows installed from just 2-3 days on that new pc so it has just few usb devices already mounted.
Here is the reports:
NewPC_USBDeview_report.html (21.66K)
Number of downloads: 4
NewPC_USB_rep.txt (317bytes)
Number of downloads: 4
I'm sorry but I lost all of you in the technical details... Where do I can find the strings RemovableMedia#8, RemovableMedia#7, ....???
And... what devices I have to sweep with DriveCleanup?
Usage: DriveCleanup [-t] [-n] [-u] [-h] [-d] [-c] [-f] [-v] -t test mode -n no wait when finished -h only USB hubs -u only USB mass storage devices -d only Disk devices -c only CDROM devices -f only Floppy devices -v only Storage Volume devices
EDIT----------------------------------------------------------
Ok cdob, maybe you are in the right way. I think this can be useful:
On the notebook, where I prepare the stick:
USB History Dump
by nabiy (c)2008
(13) --- Imation Nano USB Device
instanceID: 078B142D0BB2&0
ParentIdPrefix: 8&141a0a73&0
Driver:{4D36E967-E325-11CE-BFC1-08002BE10318}\0039
Disk Stamp: 04/21/2009 13:08
Volume Stamp: 04/21/2009 13:08
(14) --- Kingston DataTraveler 2.0 USB Device
instanceID: 2008012500000000000002E4&0
ParentIdPrefix: 8&207c63a1&0
Last Mounted As: \DosDevices\J:
Driver:{4D36E967-E325-11CE-BFC1-08002BE10318}\0027
Disk Stamp: 04/22/2009 20:47
Volume Stamp: 04/22/2009 20:47
On the new PC, where I'm trying to use that stick:
USB History Dump
by nabiy (c)2008
(1) --- Imation Nano USB Device
instanceID: 078B142D0BB2&0
ParentIdPrefix: 7&141a0a73&0
Last Mounted As: \DosDevices\H:
Driver:{4D36E967-E325-11CE-BFC1-08002BE10318}\0002
Disk Stamp: 04/24/2009 00:08
Volume Stamp: 04/24/2009 00:08
(2) --- Kingston DataTraveler 2.0 USB Device
instanceID: 2008012500000000000002E4&0
ParentIdPrefix: 7&207c63a1&0
Driver:{4D36E967-E325-11CE-BFC1-08002BE10318}\0001
Disk Stamp: 04/23/2009 03:12
Volume Stamp: 04/23/2009 03:12
This post has been edited by pipster: 23 April 2009 - 04:32 PM
#43
Posted 23 April 2009 - 04:49 PM
I replaced the old migrate.inf:
migrateOLD.inf (940bytes)
Number of downloads: 4
with this one:
migrate.inf (940bytes)
Number of downloads: 15
The second one cames from the new PC, exported \DosDevice\H: from the key HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
I just copied the value of that key \DosDevice\H: into the migrate.inf.
I want really to thanks all of you for your continuos support. I learned so many new things just reading your posts.
Thank you!
#44
Posted 23 April 2009 - 06:32 PM
So RemovableMedia#8 made the difference. In old windows it's 8, in the new install it's 7.
Reading this and cdob's link reveals the bolded part is ParentIdPrefix.
\??\STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Cdob raised the question:
Quote
There is a example http://www.forensics...History_Viewing
RemovableMedia#8 and RemovableMedia#9 is strange.
Does a notebook multi-card cause this?
Another interesting quite from the links above:
Quote
So by detecting the latter we may know that migrate.inf drive lettering may not be applied and by putting in it multiple entries for RemovableMedia#7 , 8 (any others used for USB mass storage devices?) we might get around similar issues.
@pipster
Does the new PC have any card readers?
As far as I remember you tried the USB stick on other computers, did any of them have USB card reader or any similar USB mass storage device- USB MP3 player, printer with card reader, phone connected via USB etc. etc. ?
Do you have on the old computer an USB hub or PCI USB card? Where do you connect the USB stick to?
This post has been edited by ilko_t: 23 April 2009 - 06:59 PM
#45
Posted 24 April 2009 - 02:26 AM
ilko_t, on Apr 24 2009, 02:32 AM, said:
Quote
So by detecting the latter we may know that migrate.inf drive lettering may not be applied and by putting in it multiple entries for RemovableMedia#7 , 8 (any others used for USB mass storage devices?) we might get around similar issues.
Yep, but the "ID" is not the "ParentIDPrefix".
I would say that the issue at hand is not related to Serial (or lack of it)
There are a number of entries in the USB_rep.txt that look suspicious, as they have no "ParentIDPrefix", some have "autogenerated-second-letter-&" ID's, some don't.
cdob, on Apr 23 2009, 10:10 PM, said:
Uwe offers DriveCleanup to remove USB devices from registry.
http://www.uwe-siebe...ivetools_e.html
Thanks for the reminder.
pipster, on Apr 24 2009, 12:49 AM, said:
....
I want really to thanks all of you for your continuos support. I learned so many new things just reading your posts.
Thank you!
We also learned something new, so I guess we are even.
jaclaz
#46
Posted 24 April 2009 - 02:45 AM
ilko_t, on Apr 24 2009, 02:32 AM, said:
Does the new PC have any card readers?
As far as I remember you tried the USB stick on other computers, did any of them have USB card reader or any similar USB mass storage device- USB MP3 player, printer with card reader, phone connected via USB etc. etc. ?
Do you have on the old computer an USB hub or PCI USB card? Where do you connect the USB stick to?
The new pc has no card reader. Just the USB on top of the case, connected on the mb. As you can see here: http://techgage.com/..._master_cm_690/
But on the old notebook I connected an external Hama multi card reader, maybe it is the culprit.
On my father PC there's another external multi card reader but I didn't look at registry..
jaclaz, on Apr 24 2009, 10:26 AM, said:
We also learned something new, so I guess we are even.
jaclaz
Di questo non posso che essere contento
So how do you think I can fix that usb entries on the notebook?
I have to use DriveCleanup?
What command I have to use?
-h only USB hubs
-u only USB mass storage devices
-d only Disk devices
-c only CDROM devices
-f only Floppy devices
-v only Storage Volume devices
Maybe -h -u -v ??
#47
Posted 24 April 2009 - 03:01 AM
#48
Posted 24 April 2009 - 04:34 AM
pipster, on Apr 24 2009, 10:45 AM, said:
I have to use DriveCleanup?
What command I have to use?
-h only USB hubs
-u only USB mass storage devices
-d only Disk devices
-c only CDROM devices
-f only Floppy devices
-v only Storage Volume devices
Maybe -h -u -v ??
drivecleanup -t(list all devices that will be "affected" by the command - just to be sure)
then
drivecleanup
(without parameters), that will get rid of:
Quote
- Disk devices
- CDROM devices
- Floppy devices
- Storage Volumes
jaclaz
#49
Posted 24 April 2009 - 04:58 AM
jaclaz, on Apr 24 2009, 12:34 PM, said:
drivecleanup -t(list all devices that will be "affected" by the command - just to be sure)
then
drivecleanup
(without parameters), that will get rid of:
Quote
- Disk devices
- CDROM devices
- Floppy devices
- Storage Volumes
jaclaz
Thanks
Did it. It removed a lot of things..
Then I plugged the Nano stick and... it gets parentID similar to the previous one (8&141a0a73&0):
8&141a0a73&1
With 1 at the end but always starting with 8&
I have to format this notebook when I have some time...
#50
Posted 24 April 2009 - 05:34 AM
pipster, on Apr 24 2009, 12:58 PM, said:
Did it. It removed a lot of things..
Then I plugged the Nano stick and... it gets parentID similar to the previous one (8&141a0a73&0):
8&141a0a73&1
With 1 at the end but always starting with 8&
I have to format this notebook when I have some time...
Which means obviously that the proggie did not remove the "something" that makes it get the "wrong" ParentID.
Can you do a Regedit search on that machine Registry for string:
Quote
And post results, or better yet, get Regfind.exe
http://www.petri.co....eskit_tools.htm
and run:
regfind "8&141a0a73&">foundreg.txt
You should get something similar to this (I used "7&2c889678&"):
\Registry
Machine
SYSTEM
ControlSet001
Control
DeviceClasses
{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#7&2c889678&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\7&2c889678&0&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#7&2c889678&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#7&2c889678&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\7&2c889678&0&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#7&2c889678&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Enum
USBSTOR
Disk&Ven_Generic&Prod_USB_CF_Reader&Rev_1.01
058F312D81B&1
ParentIdPrefix = 7&2c889678&0
It is possible that the tool only clears the \USBSTOR\?
jaclaz
#51
Posted 24 April 2009 - 05:46 AM
A working windows may use:
RemovableMedia#7&*&0 (that's the default)
RemovableMedia#7&*&1
RemovableMedia#8&*&0
RemovableMedia#8&*&1
and so on
jaclaz found usbhistory.
http://nabiy.sdf1.or...work=usbHistory
Quote
jaclaz said:
Machine
SYSTEM
ControlSet001
Control
DeviceClasses
{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
That's nice. Site mention this too
Quote
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
@pipster
Can you delete above entries? Remove and attach USB stick again.
To summerize a idea:
A new installed windows use RemovableMedia#7&*&0.
This pattern should go to migrate.inf.
#52
Posted 24 April 2009 - 12:42 PM
jaclaz, on Apr 24 2009, 01:34 PM, said:
Quote
And post results, or better yet, get Regfind.exe
http://www.petri.co....eskit_tools.htm
and run:
regfind "8&141a0a73&">foundreg.txt
Here's what I get:
\Registry
Machine
SYSTEM
ControlSet005
Control
DeviceClasses
{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\8&141a0a73&0&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\8&141a0a73&0&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Enum
USBSTOR
Disk&Ven_Imation&Prod_Nano&Rev_PMAP
078B142D0BB2&0
ParentIdPrefix = 8&141a0a73&0
ControlSet006
Control
DeviceClasses
{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#8&141a0a73&1&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\8&141a0a73&1&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#8&141a0a73&1&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#8&141a0a73&1&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\8&141a0a73&1&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#8&141a0a73&1&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Enum
USBSTOR
Disk&Ven_Imation&Prod_Nano&Rev_PMAP
078B142D0BB2&0
ParentIdPrefix = 8&141a0a73&1
ControlSet007
Control
DeviceClasses
{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\8&141a0a73&0&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
DeviceInstance = STORAGE\RemovableMedia\8&141a0a73&0&RM
#
SymbolicLink = \\?\STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Enum
USBSTOR
Disk&Ven_Imation&Prod_Nano&Rev_PMAP
078B142D0BB2&0
ParentIdPrefix = 8&141a0a73&0
cdob, on Apr 24 2009, 01:46 PM, said:
...
@pipster
Can you delete above entries? Remove and attach USB stick again.
To summerize a idea:
A new installed windows use RemovableMedia#7&*&0.
This pattern should go to migrate.inf.
Of course cdob but that key contains strings about IDE#DiskHTS541080G9AT00.
Is it safe to remove it?
Here is the reg export:
DeviceClasses.reg (4.9K)
Number of downloads: 1
#53
Posted 24 April 2009 - 12:53 PM
ControlSet005
ControlSet006
ControlSet007
A "normal" Windows has just ControlSet001 and ControlSet002, in some rare occasions of failure of one ControlSet I have seen ControlSet003 and ONCE in my life ControlSet004!
Please check/post contents of key:
HKEY_LOCAL_MACHINE\SYSTEM\Select
jaclaz
#54
Posted 24 April 2009 - 03:30 PM
jaclaz, on Apr 24 2009, 08:53 PM, said:
ControlSet005
ControlSet006
ControlSet007
A "normal" Windows has just ControlSet001 and ControlSet002, in some rare occasions of failure of one ControlSet I have seen ControlSet003 and ONCE in my life ControlSet004!
Please check/post contents of key:
HKEY_LOCAL_MACHINE\SYSTEM\Select
jaclaz
Here's it:
Select.reg (372bytes)
Number of downloads: 4
Hey Jaclaz you make me laugh at every post!
I didn't know about growing ControlSet00X so I'm learning more post by post on this thread, Thank you.
What's ControlSet for? I see there are strings concerning HW Device driver and IDs.
Anyway yesterday I try to install Nod32 4.0 for 2-3 times but it is causing BSOD after reboot. So I had to start Win in Last Know Good Config to remove Nod 4.0 e reinstall 3.0. Maybe it messed up the drivers loaded with the OS...
PS. I'm sorry about my english... often me too don't understand what I'm writing..
PS2. I begin to feel myself like a guinea-pig from laboratory
#55
Posted 25 April 2009 - 04:43 AM
When booting one of the available ControlSet's is chosen, based on the value of the Select key.
The chosen ControlSet is then "mirrored" (actually it is a kind of redirection/hard-link, but the effect is the same as it was a mirror) as CurrentControlSet and the latter "mirror" is actually used.
Your Select key
[HKEY_LOCAL_MACHINE\SYSTEM\Select] "Current"=dword:00000006 "Default"=dword:00000006 "Failed"=dword:00000005 "LastKnownGood"=dword:00000007
A "normal" Select key
[HKEY_LOCAL_MACHINE\SYSTEM\Select] "Current"=dword:00000001 "Default"=dword:00000001 "Failed"=dword:00000000 "LastKnownGood"=dword:00000002
In normal operation, ControlSet001 is always used, in case it fails due to corruption or whatever reason, you are given when booting the option to choose "Last Known Good" (or "Ultima configurazione sicuramente funzionante"), if you choose that, then try again booting normally and it doesn't boot, the key changes to:
Quote
"Current"=dword:0000000
"Default"=dword:0000000
"Failed"=dword:0000000
"LastKnownGood"=dword:0000000
And a new ControlSet, ControlSet00n+3, copy of the "last known good" or n+2 is created.
Usually when the above happens, it is time to understand what caused the failure and fix the Registry.
However his would be outside the scope of the thread, check these if you are interested:
http://www.pcreview....ead-3161118.php
http://support.micro....com/kb/102984/
http://support.micro....com/kb/302829/
http://www.geocities...t_services.html
Back to your guinea pig duties
You can delete allright the keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
in each 00n ControlSet you can find them.
DO NOT delete the whole:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\
DO NOT delete the whole:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}\
DO NOT delete the whole:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
jaclaz
This post has been edited by jaclaz: 25 April 2009 - 04:44 AM
#56
Posted 25 April 2009 - 05:32 AM
pipster, on Apr 24 2009, 12:42 PM, said:
Is it safe to remove it?
Keep this nice testing machine. Don't remove settings.
There is a new MkMigratgeInf_b.cmd attached. Try this version.
This version use a pattern RemovableMedia#7&*&0
7 and 0 are fixed, if there another values.
Version outdated, removed. Update at http://www.msfn.org/board/index.php?s=&...st&p=880257
This post has been edited by cdob: 31 August 2009 - 03:11 PM
#57
Posted 25 April 2009 - 06:07 AM
#58
Posted 25 April 2009 - 12:16 PM
jaclaz, on Apr 25 2009, 12:43 PM, said:
Back to your guinea pig duties
You can delete allright the keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00n\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#RemovableMedia#8&141a0a73&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
in each 00n ControlSet you can find them.
jaclaz
Ok deleted. Thanks for the lessons mate!
cdob, on Apr 25 2009, 01:32 PM, said:
Ok. It's official. I'm a guinea pig...
cdob, on Apr 25 2009, 01:32 PM, said:
This version use a pattern RemovableMedia#7&*&0
7 and 0 are fixed, if there another values.
Are you saying to use it with WinSetupFromUSB to make a new USBstick?
I ran it on the desktop. It produce this MIGRATE.INF:
[Version] Signature = "$Windows NT$" [Addreg] HKLM,"SYSTEM\MountedDevices",,0x00000010 HKLM,"SYSTEM\ControlSet001\Control\StorageDevicePolicies","WriteProtect",0x00010001,1 HKLM,"SYSTEM\MountedDevices","\DosDevices\U:",0x00030001,\ 24,2C,38,DB,00,BE,3A,83,02,00,00,00
jaclaz, on Apr 25 2009, 02:07 PM, said:
You're an accomplice, I know!
This post has been edited by pipster: 25 April 2009 - 12:18 PM
#59
Posted 25 April 2009 - 12:40 PM
pipster, on Apr 25 2009, 08:16 PM, said:
And, AGAIN
You need to open a Command Prompt window and run it giving it a parameter, i.e. the drive letter that currently your USB sticks has.
Just as ilko_t made you run it before
http://www.msfn.org/board/index.php?showto...31770&st=29
jaclaz
#60
Posted 25 April 2009 - 01:09 PM
pipster, on Apr 25 2009, 12:16 PM, said:
I ran it on the desktop.
Run this at the nice testing machine: the notebook.
Remember the machine produced ParentIdPrefix
Quote
ParentIdPrefix: 8&141a0a73&0
(14) --- Kingston DataTraveler 2.0 USB Device
ParentIdPrefix: 8&207c63a1&0
Or
Quote
8&141a0a73&1
The new batch should convert this settings to 7&141a0a73&0 and 7&207c63a1&0.
Use the previous command as jaclaz pointed.
Or copy MkMigratgeInf_b.cmd to the USB stick and run MkMigratgeInf_b.cmd direct.
- ← boot os selection after install xp
- Install Windows from USB
- winsetupfromusb 0.2.3 boot iso feature & xp setup iso →



Help


Back to top









