On Thu, 10 Nov 2022 14:59:08 -0600, jetjock <jetjock@unkown.com>
wrote:

>On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
>wrote:
>
>>On 10/11/2022 15:59, jetjock wrote:
>>>
>>> On Wed, 09 Nov 2022 14:41:15 -0600, jetjock <jetjock@unkown.com>
>>> wrote:
>>>>
>>>> On Tue, 8 Nov 2022 19:26:36 +0000, Java Jive <java@evij.com.invalid>
>>>> wrote:
>>>>
>>>>> On 08/11/2022 17:22, jetjock wrote:
>>>
>>> This info didn't make it from the draft to the post.
>>>
>>> You had asked:
>>>
>>>> "While I can see some reason for the first of the extras, the Avast one,
>>>> and perhaps the second extra, fltsrv.sys, which apparently is an Acronis driver,
>>>> what is the third, vidsft.sys? What information do you see in the bottom of the
>>>> dialog box when you highlight it?"
>>>
>>> More strange happenings! I disabled Avast temporarily to see if that
>>> might fix anything...it didn't, but when I enabled it again
>>> \vidsflt.sys was gone and \iaStorF.sys Dialog says that the Provider
>>> is Intel Corporation, File version 14.8.18.1066. Copyright Intel and
>>> Digital Signer: Microsoft Windows Hardware Compatibility.
>>
>>Should be fine.
>>
>>> vidsflt.sys's description is "Acronis Virtual Disk Storage Filter"
>>
>>Sounds like either a driver for imaging disks, or one for making the
>>resulting files of disk images to appear as virtual disks. As I don't
>>use Acronis, I'm not sure which, but others may be able to help.
>>
>>> iastorf.sys's description is "Intel Rapid Storage Technology Filter
>>> driver - x64" Both of these were found doing a DuckDuckGo search at
>>> Freefixer.com
>>
>>Fine.
>>
>>We know that the above is different from my machine, but the best
>>comparison to make here would be with your wife's machine, as that is
>>using the same SanDisk, so, as previously requested, I'd like to see
>>this same driver information from your wife's computer as well.
>>
>>However, I'll stick my neck out now and say that this is beginning to
>>look like some sort of obscure and unwanted interaction between one or
>>more of these extra drivers/processes. Particularly, it sometimes
>>happens that running two AV or similar services at the same time can
>>cause unwanted interactions between the two, so one thing you could try
>>is temporarily ...
>>
>>1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>
>Not possible. I can disable Acronis but the only way to shut down
>Avast is to un-install it. Whenever I try to stop the process it
>throws an access denied.
>
>I am officially throwing in the towel! I can't tell you much I
>appreciate all the help you have provided. I'm just sorry we weren't
>able to solve the mystery. I guess I'll just have to use that drive on
>other computers. It will be interesting to see what happens when the
>new drive gets here later today. If my machine won't recognize it, I
>guess it's time for a Windows re-install. :-( Thanks again!!
>>
>>2 Re-enable only, say, Avast, reboot, and try again;
>>
>>3 Disable the first and re-enable only the second, reboot, and try again;
>>
>>4 Re-enable both, reboot and try again.
>>
>>>>>> Drive has never been encrypted (intentionally, anyway) by me. I have
>>>>>> checked "Services" on both computers and Bitlocker is either stopped
>>>>>> or disabled on both.
>>>>>
>>>>> So the startup settings on the BitLocker service are different on the
>>>>> two machines, the one that works and the one that doesn't? I'll hazard
>>>>> a guess, disabled on the one that works, automatic or manual on the one
>>>>> that doesn't? Please tell us the exact settings on both.
>>>>
>>>> BDESVC is "Stopped" & "Disabled on my (doesn't work) computer and
>>>> "Stopped" and "Manual" on wife's (works) machine. Neither has ever
>>>> been turned on except yesterday when I turned mine on just to see if
>>>> that would make a difference...it didn't. It's "Stopped" now.
>>
>>That's another thing you could try: copy the BitLocker settings from
>>your wife's PC to your own, reboot, and try again.
>>
>>>>> More generally, the means of curing this is to compare the two machines,
>>>>> the one that works against the one that doesn't. Upthread, at the end
>>>>> of my mail of 7/11 14:24, I suggested that you compared the processes
>>>>> running on both, and gave some instructions for doing so, labelled 'D'
>>>>> to distinguish them from other sets of instructions in the same mail.
>>>>> Did you ever get around to doing this?
>>>>
>>>> Sorry yesterday was a busy day and I must have missed that part,
>>>> Anyway, I did a side-by-side comparison and here is what I found:
>>>>
>>>> On my computer, but not wife's:
>>>>
>>>> 01.anti_ransomware_service.exe *32 Acronis Active Protection Service
>>
>>May be involved in some sort of interaction, as described above.
>>
>>>> 02.atkexComSvc.exe *32 Asus
>>
>>Should be fine.
>>
>>>> 03.BrStMonW.exe *32 Brother Staus Monitor
>>
>>Should be fine, though see note below.
>>
>>>> 04.CS5Service Manager.exe *32 Adobe CS5 Service Mgr.
>>
>>See note below.
>>
>>>> 05.GoogleCrashHandler.exe *32 Google Crash Handler
>>>> 06.GoogleCrashHandler.exe *64 Google Crash Handler
>>
>>I uninstalled Chrome when an update to it hi-jacked all my browser
>>settings to make it the default browser without so much as a
>>by-your-leave, and it took re-imaging the PC from a back-up to put
>>things back to how they were before. Even then, ISTR that it still left
>>some shit rather like this behind which I had to uninstall manually. Do
>>you use Chrome, or any other Google software? If not, certainly disable
>>these. If you do, I suspect that it shouldn't be loading both 64 and
>>32-bit versions - one or the other perhaps, but not both, but anyway,
>>IIRC, all it's doing is hanging around waiting to report any crashes to
>>Google, so see note below.
>>
>>>> 07.igfxCUIService.exe Intel Graphics Properties
>>>> 08.igfxHK.exe Graphics Related Hotkeys
>>Fine.
>>
>>>> 09.IntuitUpdateService.exe Self Explanatory
>>
>>Probably fine, but see note below.
>>
>>>> 10.IPROSetMonitor.exe (See note at bottom)
>>
>>Wifi configuration, should be fine.
>>
>>>> 11.iusb3mon.exe (See note at bottom)
>>
>>Fine.
>>
>>>> 12.nusb3mon *32 Renesas USB3 Card
>>
>>Should be fine.
>>
>>>> 13.OSPPSVC.EXE MS Office Protection Svc
>>
>>Fine, but you can set this one to Manual, see note below
>>
>>>> 14.ss_conn_service.exe (See note at bottom)
>>
>>Samsung USB phone driver. Fine.
>>
>>>> 15.StkCSrv.exe No idea what this is! Says it's Syntek
>>>> Hardware Snapshot Launch Application. No
>>>> Clue what that is!
>>
>>Seems to handle taking snapshots from webcam. Probably fine.
>>
>>>> There are a few other things on my machine not on wife's, but they are
>>>> self explanatory to me and not associated with the problem.
>>>>
>>>> Here are a couple things on wife's processes that aren't on mine, but
>>>> I can't see either of them being applicable:
>>>>
>>>> 1.syncagentsrv.exe True Image Sync Agt. Serv.
>>
>>Image backup service. See note below.
>>
>>>> 2.wmpnetwk.exe Win Media Play Net Shar. Svc.
>>
>>Running when windows media player is or has been running. Fine.
>>
>>Note: Generally, you have a great deal of bloatware running, by which I
>>mean things constantly running in the background that don't really need
>>to be.
>>
>>So-called 'quick launch services' are the classic examples of these.
>>Adobe used to install a service whose sole purpose was to load all the
>>necessary DLLs for its reader on the off-chance that you might want to
>>read a PDF, but, if you didn't, and all the time until you did, it was
>>sitting in the background consuming system resources such as page file
>>space, just so that if you happened to double-click a PDF the reader
>>would appear to load more quickly than otherwise it would have.
>>Effectively all quick launchers achieve is to make particular software
>>appear faster than it really is by making its host machine genuinely
>>slower than it really needs to be.
>>
>>Software updaters are another. There is no need to be constantly
>>monitoring websites for updates, for non-security software, a
>>half-daily, daily, weekly, or monthly Task Scheduler job should be able
>>to launch a one-off check that exits once completed.
>>
>>Another is control and status monitors for hardware such as printers.
>>These only need to be loaded when you are actually using the hardware
>>such as printing something. There may be something in its settings that
>>you can change to make this to happen.
>>
>>Your wife's machine has one too, the imaging backup service. Most
>>machines don't change often enough that a constantly running image back
>>up needs to be made, something like a weekly or monthly image is
>>adequate for most people, and, at least in principle, this could be done
>>either manually or by Task Scheduler. However, as I backup my PCs
>>manually using Ghost, I can't comment on how best to set up True Image.
>>
>>By such bloatware, a perfectly specced machine is made to seem slow and
>>outdated, and you are persuaded to upgrade it to a newer one! A further
>>complication is that the more such bloatware you have running, the more
>>likely it will be that you have some unanticipated and obscure
>>interaction, such as may be happening here.
>>
>>I always recommended disabling such bloatware, either by disabling the
>>service in the case of quick launchers, or by setting the startup mode
>>of the service from Automatic to Manual in the case of things like
>>status monitors, etc. You may care to experiment along these lines, but
>>make careful and accurate notes of from what to what you change while
>>doing so, so that if you break something it can easily be restored.

On 11/11/2022 03:31, jetjock wrote:
>
> On Thu, 10 Nov 2022 14:59:08 -0600, jetjock <jetjock@unkown.com>
> wrote:
>
>> On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
>>>
>>> However, I'll stick my neck out now and say that this is beginning to
>>> look like some sort of obscure and unwanted interaction between one or
>>> more of these extra drivers/processes. Particularly, it sometimes
>>> happens that running two AV or similar services at the same time can
>>> cause unwanted interactions between the two, so one thing you could try
>>> is temporarily ...
>>>
>>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>
>> Not possible. I can disable Acronis but the only way to shut down
>> Avast is to un-install it. Whenever I try to stop the process it
>> throws an access denied.

If you were ever minded to continue this investigation, try doing this
in safe mode.

>> I am officially throwing in the towel! I can't tell you much I
>> appreciate all the help you have provided. I'm just sorry we weren't
>> able to solve the mystery. I guess I'll just have to use that drive on
>> other computers. It will be interesting to see what happens when the
>> new drive gets here later today. If my machine won't recognize it, I
>> guess it's time for a Windows re-install. :-( Thanks again!!

Fair enough. As I said before, it's always up to you when you choose to
stop. I'm kinda stubborn, and tend to keep going, but it also depends
on what other things are happening at the time. All of us have the rest
of our lives to live!

>>> 2 Re-enable only, say, Avast, reboot, and try again;
>>>
>>> 3 Disable the first and re-enable only the second, reboot, and try again;
>>>
>>> 4 Re-enable both, reboot and try again.
>>>
>>> That's another thing you could try: copy the BitLocker settings from
>>> your wife's PC to your own, reboot, and try again.
>
> Plugged new 64GB Kingston drive into USB 3 port and computer
> recognized it immediately. Don't know what happened to the SanDisk
> drive to male it unreadable, but at least it isn't my computer that's
> the problem.

Glad that you've got something working now.

> Once again, a million thank yous for all the assistance!

That's fine, pity we didn't actually crack it, though.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On Fri, 11 Nov 2022 13:25:38 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 11/11/2022 03:31, jetjock wrote:
>>
>> On Thu, 10 Nov 2022 14:59:08 -0600, jetjock <jetjock@unkown.com>
>> wrote:
>>
>>> On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
>>>>
>>>> However, I'll stick my neck out now and say that this is beginning to
>>>> look like some sort of obscure and unwanted interaction between one or
>>>> more of these extra drivers/processes. Particularly, it sometimes
>>>> happens that running two AV or similar services at the same time can
>>>> cause unwanted interactions between the two, so one thing you could try
>>>> is temporarily ...
>>>>
>>>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>>
>>> Not possible. I can disable Acronis but the only way to shut down
>>> Avast is to un-install it. Whenever I try to stop the process it
>>> throws an access denied.
>
>If you were ever minded to continue this investigation, try doing this
>in safe mode.

Great idea! I was going to do that yesterday, but somehow got waylaid
by other chores. Oh, I remember now. I tried renaming the driver that
was listed for the Acronis part SanDisk properties, and got a BSD!
Took a few minutes to repair that and then I forgot about safe mode!
Great memory...just very short! :-) Will try now and let you know.
>
>>> I am officially throwing in the towel! I can't tell you much I
>>> appreciate all the help you have provided. I'm just sorry we weren't
>>> able to solve the mystery. I guess I'll just have to use that drive on
>>> other computers. It will be interesting to see what happens when the
>>> new drive gets here later today. If my machine won't recognize it, I
>>> guess it's time for a Windows re-install. :-( Thanks again!!
>
>Fair enough. As I said before, it's always up to you when you choose to
>stop. I'm kinda stubborn, and tend to keep going, but it also depends
>on what other things are happening at the time. All of us have the rest
>of our lives to live!

Me too. As I said, I hate to let the computer win! Sometimes, one just
has to admit defeat.
>
>>>> 2 Re-enable only, say, Avast, reboot, and try again;
>>>>
>>>> 3 Disable the first and re-enable only the second, reboot, and try again;
>>>>
>>>> 4 Re-enable both, reboot and try again.
>>>>
>>>> That's another thing you could try: copy the BitLocker settings from
>>>> your wife's PC to your own, reboot, and try again.
>>
>> Plugged new 64GB Kingston drive into USB 3 port and computer
>> recognized it immediately. Don't know what happened to the SanDisk
>> drive to male it unreadable, but at least it isn't my computer that's
>> the problem.
>
>Glad that you've got something working now.
>
>> Once again, a million thank yous for all the assistance!
>
>That's fine, pity we didn't actually crack it, though.

>>>>>>>>>>jetjock<<<<<<<<<<

On Fri, 11 Nov 2022 09:56:41 -0600, jetjock <jetjock@unkown.com>
wrote:

>On Fri, 11 Nov 2022 13:25:38 +0000, Java Jive <java@evij.com.invalid>
>wrote:
>
>>On 11/11/2022 03:31, jetjock wrote:
>>>
>>> On Thu, 10 Nov 2022 14:59:08 -0600, jetjock <jetjock@unkown.com>
>>> wrote:
>>>
>>>> On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
>>>>>
>>>>> However, I'll stick my neck out now and say that this is beginning to
>>>>> look like some sort of obscure and unwanted interaction between one or
>>>>> more of these extra drivers/processes. Particularly, it sometimes
>>>>> happens that running two AV or similar services at the same time can
>>>>> cause unwanted interactions between the two, so one thing you could try
>>>>> is temporarily ...
>>>>>
>>>>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>>>
>>>> Not possible. I can disable Acronis but the only way to shut down
>>>> Avast is to un-install it. Whenever I try to stop the process it
>>>> throws an access denied.
>>
>>If you were ever minded to continue this investigation, try doing this
>>in safe mode.
>
>Great idea! I was going to do that yesterday, but somehow got waylaid
>by other chores. Oh, I remember now. I tried renaming the driver that
>was listed for the Acronis part SanDisk properties, and got a BSD!
>Took a few minutes to repair that and then I forgot about safe mode!
>Great memory...just very short! :-) Will try now and let you know.

Safe Boot didn't solve the problem, but it did show a couple of
interesting things. Here are links to:

1.Normal Boot Devices & Printers.
https://www.sendspace.com/file/v083ic

2. Safe Boot Devices & Printers.
https://www.sendspace.com/file/x2i2i1

3. SanDisk Normal Boot properties.
https://www.sendspace.com/file/gxi4bn

4. SanDisk Safe Boot properties.
https://www.sendspace.com/file/k5jfqk

As I said, interesting, but not very useful. Even though safe mode did
not have the WPD File System Volume Driver (which is apparently the
problem, the drive still didn't show up there in a file manager. If I
manually delete that driver, it is just re-installed the next time I
plug the drive in.

So, unless the above gives you any brilliant insight, I'm afraid I'm
out of ideas. Thanks again!
>>
>>>> I am officially throwing in the towel! I can't tell you much I
>>>> appreciate all the help you have provided. I'm just sorry we weren't
>>>> able to solve the mystery. I guess I'll just have to use that drive on
>>>> other computers. It will be interesting to see what happens when the
>>>> new drive gets here later today. If my machine won't recognize it, I
>>>> guess it's time for a Windows re-install. :-( Thanks again!!
>>
>>Fair enough. As I said before, it's always up to you when you choose to
>>stop. I'm kinda stubborn, and tend to keep going, but it also depends
>>on what other things are happening at the time. All of us have the rest
>>of our lives to live!
>
>Me too. As I said, I hate to let the computer win! Sometimes, one just
>has to admit defeat.
>>
>>>>> 2 Re-enable only, say, Avast, reboot, and try again;
>>>>>
>>>>> 3 Disable the first and re-enable only the second, reboot, and try again;
>>>>>
>>>>> 4 Re-enable both, reboot and try again.
>>>>>
>>>>> That's another thing you could try: copy the BitLocker settings from
>>>>> your wife's PC to your own, reboot, and try again.
>>>
>>> Plugged new 64GB Kingston drive into USB 3 port and computer
>>> recognized it immediately. Don't know what happened to the SanDisk
>>> drive to male it unreadable, but at least it isn't my computer that's
>>> the problem.
>>
>>Glad that you've got something working now.
>>
>>> Once again, a million thank yous for all the assistance!
>>
>>That's fine, pity we didn't actually crack it, though.
>
> >>>>>>>>>>jetjock<<<<<<<<<<

>>>>>>>>>>jetjock<<<<<<<<<<

On 11/11/2022 17:16, jetjock wrote:
> On Fri, 11 Nov 2022 09:56:41 -0600, jetjock <jetjock@unkown.com>
> wrote:
>
>> On Fri, 11 Nov 2022 13:25:38 +0000, Java Jive <java@evij.com.invalid>
>> wrote:
>>
>>> On 11/11/2022 03:31, jetjock wrote:
>>>>
>>>> On Thu, 10 Nov 2022 14:59:08 -0600, jetjock <jetjock@unkown.com>
>>>> wrote:
>>>>
>>>>> On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
>>>>>>
>>>>>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>>>>
>>>>> Not possible. I can disable Acronis but the only way to shut down
>>>>> Avast is to un-install it. Whenever I try to stop the process it
>>>>> throws an access denied.

Before answering your specific point below, let me remind you that a
simple thing you could try is to ensure that you copy the BitLocker
service settings exactly from your wife's PC to your own, reboot, and
try the problem SanDisk again.

>>>
>>> If you were ever minded to continue this investigation, try doing this
>>> in safe mode.
>>
>> Great idea! I was going to do that yesterday, but somehow got waylaid
>> by other chores. Oh, I remember now. I tried renaming the driver that
>> was listed for the Acronis part SanDisk properties, and got a BSD!
>> Took a few minutes to repair that and then I forgot about safe mode!
>> Great memory...just very short! :-) Will try now and let you know.

I meant, as you were unable to disable the Avast and/or Acronis services
in 'normal' mode, try doing so in Safe Mode, then rebooting into
'normal' mode to check that what you had disabled in Safe Mode was
really still disabled in 'normal' mode, and then see if you were able to
use the SanDisk, as per the following sequence of tests:

1 Disable both Avast and Acronis, reboot, and try the SanDisk again;

2 Re-enable only, say, Avast, reboot, and try again;

3 Disable the first and re-enable only the second, reboot, and try again;

4 Re-enable both, reboot and try again.

> Safe Boot didn't solve the problem, but it did show a couple of
> interesting things. Here are links to:
>
> 1.Normal Boot Devices & Printers.
> https://www.sendspace.com/file/v083ic
>
> 2. Safe Boot Devices & Printers.
> https://www.sendspace.com/file/x2i2i1
>
> 3. SanDisk Normal Boot properties.
> https://www.sendspace.com/file/gxi4bn
>
> 4. SanDisk Safe Boot properties.
> https://www.sendspace.com/file/k5jfqk
>
> As I said, interesting, but not very useful. Even though safe mode did
> not have the WPD File System Volume Driver (which is apparently the
> problem, the drive still didn't show up there in a file manager.

Generally, TBH, only rarely do I find 'Devices and Printers' to be
useful, and consequently hardly ever look at it. When a device problem
occurs, usually I go straight to Device Manager. Whether this is good
or bad, others will have to judge.

Specifically here, as you say, it's not particularly useful, as you
weren't able to disable any of the services suspected to be interacting
with each other.

But try the simple thing first, copying the BitLocker service settings
exactly from your wife's PC to your own.

> If I
> manually delete that driver, it is just re-installed the next time I
> plug the drive in.

Yes, what you'd have to do is, in Safe Mode, rename the driver in both
of ...
%WinDir%\System32\Drivers
%WinDir%\System32\DriverStore\FileRepository
.... where you'd have to search the latter for the sub-directory/ies
containing the back-up file.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On Sat, 12 Nov 2022 14:26:30 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 11/11/2022 17:16, jetjock wrote:
>> On Fri, 11 Nov 2022 09:56:41 -0600, jetjock <jetjock@unkown.com>
>> wrote:
>>
>>> On Fri, 11 Nov 2022 13:25:38 +0000, Java Jive <java@evij.com.invalid>
>>> wrote:
>>>
>>>> On 11/11/2022 03:31, jetjock wrote:
>>>>>
>>>>> On Thu, 10 Nov 2022 14:59:08 -0600, jetjock <jetjock@unkown.com>
>>>>> wrote:
>>>>>
>>>>>> On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
>>>>>>>
>>>>>>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>>>>>
>>>>>> Not possible. I can disable Acronis but the only way to shut down
>>>>>> Avast is to un-install it. Whenever I try to stop the process it
>>>>>> throws an access denied.
>
>Before answering your specific point below, let me remind you that a
>simple thing you could try is to ensure that you copy the BitLocker
>service settings exactly from your wife's PC to your own, reboot, and
>try the problem SanDisk again.

Settings are identical.
>
>>>>
>>>> If you were ever minded to continue this investigation, try doing this
>>>> in safe mode.
>>>
>>> Great idea! I was going to do that yesterday, but somehow got waylaid
>>> by other chores. Oh, I remember now. I tried renaming the driver that
>>> was listed for the Acronis part SanDisk properties, and got a BSD!
>>> Took a few minutes to repair that and then I forgot about safe mode!
>>> Great memory...just very short! :-) Will try now and let you know.
>
>I meant, as you were unable to disable the Avast and/or Acronis services
>in 'normal' mode, try doing so in Safe Mode, then rebooting into
>'normal' mode to check that what you had disabled in Safe Mode was
>really still disabled in 'normal' mode, and then see if you were able to
>use the SanDisk, as per the following sequence of tests:
>
>1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>
>2 Re-enable only, say, Avast, reboot, and try again;
>
>3 Disable the first and re-enable only the second, reboot, and try again;
>
>4 Re-enable both, reboot and try again.

This made no difference.
>
>> Safe Boot didn't solve the problem, but it did show a couple of
>> interesting things. Here are links to:
>>
>> 1.Normal Boot Devices & Printers.
>> https://www.sendspace.com/file/v083ic
>>
>> 2. Safe Boot Devices & Printers.
>> https://www.sendspace.com/file/x2i2i1
>>
>> 3. SanDisk Normal Boot properties.
>> https://www.sendspace.com/file/gxi4bn
>>
>> 4. SanDisk Safe Boot properties.
>> https://www.sendspace.com/file/k5jfqk
>>
>> As I said, interesting, but not very useful. Even though safe mode did
>> not have the WPD File System Volume Driver (which is apparently the
>> problem, the drive still didn't show up there in a file manager.
>
>Generally, TBH, only rarely do I find 'Devices and Printers' to be
>useful, and consequently hardly ever look at it. When a device problem
>occurs, usually I go straight to Device Manager. Whether this is good
>or bad, others will have to judge.
>
>Specifically here, as you say, it's not particularly useful, as you
>weren't able to disable any of the services suspected to be interacting
>with each other.
>
>But try the simple thing first, copying the BitLocker service settings
>exactly from your wife's PC to your own.
>
>
>> If I
>> manually delete that driver, it is just re-installed the next time I
>> plug the drive in.
>
>Yes, what you'd have to do is, in Safe Mode, rename the driver in both
>of ...
> %WinDir%\System32\Drivers
> %WinDir%\System32\DriverStore\FileRepository
>... where you'd have to search the latter for the sub-directory/ies
>containing the back-up file.

>>>>>>>>>>jetjock<<<<<<<<<<

On 12/11/2022 22:07, jetjock wrote:
>
> On Sat, 12 Nov 2022 14:26:30 +0000, Java Jive <java@evij.com.invalid>
> wrote:
>>
>> Before answering your specific point below, let me remind you that a
>> simple thing you could try is to ensure that you copy the BitLocker
>> service settings exactly from your wife's PC to your own, reboot, and
>> try the problem SanDisk again.
>
> Settings are identical.

I thought you said earlier that they weren't?

>>>>> If you were ever minded to continue this investigation, try doing this
>>>>> in safe mode.
>>>>
>>>> Great idea! I was going to do that yesterday, but somehow got waylaid
>>>> by other chores. Oh, I remember now. I tried renaming the driver that
>>>> was listed for the Acronis part SanDisk properties, and got a BSD!
>>>> Took a few minutes to repair that and then I forgot about safe mode!
>>>> Great memory...just very short! :-) Will try now and let you know.
>>
>> I meant, as you were unable to disable the Avast and/or Acronis services
>> in 'normal' mode, try doing so in Safe Mode, then rebooting into
>> 'normal' mode to check that what you had disabled in Safe Mode was
>> really still disabled in 'normal' mode, and then see if you were able to
>> use the SanDisk, as per the following sequence of tests:
>>
>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>
>> 2 Re-enable only, say, Avast, reboot, and try again;
>>
>> 3 Disable the first and re-enable only the second, reboot, and try again;
>>
>> 4 Re-enable both, reboot and try again.
>
> This made no difference.

I think we must both accept defeat, there's a limit to what I can
achieve 'by proxy' as it were, and anyway you have the new working
SanDisk now.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On Sun, 13 Nov 2022 12:53:35 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 12/11/2022 22:07, jetjock wrote:
>>
>> On Sat, 12 Nov 2022 14:26:30 +0000, Java Jive <java@evij.com.invalid>
>> wrote:
>>>
>>> Before answering your specific point below, let me remind you that a
>>> simple thing you could try is to ensure that you copy the BitLocker
>>> service settings exactly from your wife's PC to your own, reboot, and
>>> try the problem SanDisk again.
>>
>> Settings are identical.
>
>I thought you said earlier that they weren't?

It's possible they weren't. I've made so many changes I can't be sure
that I haven't changed them also. :-(
>
>>>>>> If you were ever minded to continue this investigation, try doing this
>>>>>> in safe mode.
>>>>>
>>>>> Great idea! I was going to do that yesterday, but somehow got waylaid
>>>>> by other chores. Oh, I remember now. I tried renaming the driver that
>>>>> was listed for the Acronis part SanDisk properties, and got a BSD!
>>>>> Took a few minutes to repair that and then I forgot about safe mode!
>>>>> Great memory...just very short! :-) Will try now and let you know.
>>>
>>> I meant, as you were unable to disable the Avast and/or Acronis services
>>> in 'normal' mode, try doing so in Safe Mode, then rebooting into
>>> 'normal' mode to check that what you had disabled in Safe Mode was
>>> really still disabled in 'normal' mode, and then see if you were able to
>>> use the SanDisk, as per the following sequence of tests:
>>>
>>> 1 Disable both Avast and Acronis, reboot, and try the SanDisk again;
>>>
>>> 2 Re-enable only, say, Avast, reboot, and try again;
>>>
>>> 3 Disable the first and re-enable only the second, reboot, and try again;
>>>
>>> 4 Re-enable both, reboot and try again.
>>
>> This made no difference.
>
>I think we must both accept defeat, there's a limit to what I can
>achieve 'by proxy' as it were, and anyway you have the new working
>SanDisk now.

I agree. You've been more than generous with your time and expertise.
I really appreciate it!

>>>>>>>>>>jetjock<<<<<<<<<<

On 11/13/2022 11:30 AM, jetjock wrote:

>
> I agree. You've been more than generous with your time and expertise.
> I really appreciate it!

When you plug in your USB stick, does a row show up
in Disk Management (with no recognizable partitions),
or does it not show up at all ?

This tool (downloads at bottom), shows whether "endpoints"
have formed, when you plug in a USB stick.

https://www.uwe-sieber.de/usbtreeview_e.html

A USB stick cannot go anywhere, if endpoints don't form.
(Hardware problem, stick not fully seated, stick works in
USB2 socket but not USB3 socket.)

If the Class field can be seen, then the OS should sniff the
class and determine the device is a USB Mass Storage. Even if
there is an all-zeros MBR, the drive should then show up as
a row in Disk Management. It will then beg to be assigned
MBR or GPT status, if the thing is blank. Those are the two
partitioning options for storage. When trying to recover a
stick, of course you would not accept any offer it makes.

In Device Manager, if the Endpoints formed and comms
were established with the stick, then the stick should show
up in the USB section.

*******

As for how far out in edge-city you could go, if Disk Management
shows a row, these are some examples.

You don't want to read too much of this. However, the word "-FVE-FS-"
stands out.

https://github.com/libyal/libbde/blob/main/documentation/BitLocker%20Drive%20Encryption%20%28BDE%29%20format.asciidoc

If the USB drive shows up as a row in Disk Management, you could use HxD
hex editor, and when running the tool as Administrator, you can scan
the physical sectors for that eight character "-FVE-FS-" string. That
string should not show up on "ordinary" USB sticks :-) I think
HxD is keeping its preferences in a folder now (like in your Downloads folder).

https://en.wikipedia.org/wiki/HxD

http://mh-nexus.de/hxd

This tool can dump some of the metadata from fve-fs (Full Volume Encryption File System).
The binary for this, is "offered" by the developer via Appveyor, and fortunately
the "Artifacts" have been automatically deleted. Appveyor is very dangerous,
and you can definitely get malware from there. It's totally automated with
nobody minding the shop. I pulled something from there once, scanned it,
and it lit up like a pig. A shame really. But that's the Internet for you.
Building this from source, forget it. It's VS22 plus lots of mumbo-jumbo.
About all you can do, is scroll down and see just how much information
about file systems, you currently do not have access to.

https://www.kitploit.com/2021/10/ntfstool-forensics-tool-for-ntfs-parser.html

Paul

On Tue, 15 Nov 2022 19:31:42 -0500, Paul <nospam@needed.invalid>
wrote:

>On 11/13/2022 11:30 AM, jetjock wrote:
>
>>
>> I agree. You've been more than generous with your time and expertise.
>> I really appreciate it!
>
>When you plug in your USB stick, does a row show up
>in Disk Management (with no recognizable partitions),
>or does it not show up at all ?

It shows up as: SANDISK nor drive letter, 28.97 GB FAT 32, Healthy
(Primary Partition).

When JavaJive and I were working this problem earlier, I had assigned
X: as it's letter so I assigned it again just now. I then checked my
file manager and low and behold, there it was!! I have absolutely no
idea how that happened as I haven't touched that drive for about a
week now. Computer has been restarted several times and shut down a
couple, but this is the first time I have plugged that drive in for
about a week.

Thanks for fixing it for me!! ;-)
>
>This tool (downloads at bottom), shows whether "endpoints"
>have formed, when you plug in a USB stick.
>
>https://www.uwe-sieber.de/usbtreeview_e.html
>
>A USB stick cannot go anywhere, if endpoints don't form.
>(Hardware problem, stick not fully seated, stick works in
>USB2 socket but not USB3 socket.)
>
>If the Class field can be seen, then the OS should sniff the
>class and determine the device is a USB Mass Storage. Even if
>there is an all-zeros MBR, the drive should then show up as
>a row in Disk Management. It will then beg to be assigned
>MBR or GPT status, if the thing is blank. Those are the two
>partitioning options for storage. When trying to recover a
>stick, of course you would not accept any offer it makes.
>
>In Device Manager, if the Endpoints formed and comms
>were established with the stick, then the stick should show
>up in the USB section.
>
>*******
>
>As for how far out in edge-city you could go, if Disk Management
>shows a row, these are some examples.
>
>You don't want to read too much of this. However, the word "-FVE-FS-"
>stands out.
>
>https://github.com/libyal/libbde/blob/main/documentation/BitLocker%20Drive%20Encryption%20%28BDE%29%20format.asciidoc
>
>If the USB drive shows up as a row in Disk Management, you could use HxD
>hex editor, and when running the tool as Administrator, you can scan
>the physical sectors for that eight character "-FVE-FS-" string. That
>string should not show up on "ordinary" USB sticks :-) I think
>HxD is keeping its preferences in a folder now (like in your Downloads folder).
>
>https://en.wikipedia.org/wiki/HxD
>
> http://mh-nexus.de/hxd
>
>This tool can dump some of the metadata from fve-fs (Full Volume Encryption File System).
>The binary for this, is "offered" by the developer via Appveyor, and fortunately
>the "Artifacts" have been automatically deleted. Appveyor is very dangerous,
>and you can definitely get malware from there. It's totally automated with
>nobody minding the shop. I pulled something from there once, scanned it,
>and it lit up like a pig. A shame really. But that's the Internet for you.
>Building this from source, forget it. It's VS22 plus lots of mumbo-jumbo.
>About all you can do, is scroll down and see just how much information
>about file systems, you currently do not have access to.
>
>https://www.kitploit.com/2021/10/ntfstool-forensics-tool-for-ntfs-parser.html
>
> Paul

>>>>>>>>>>jetjock<<<<<<<<<<

On 16/11/2022 15:19, jetjock wrote:
>
> On Tue, 15 Nov 2022 19:31:42 -0500, Paul <nospam@needed.invalid>
> wrote:
>>
>> When you plug in your USB stick, does a row show up
>> in Disk Management (with no recognizable partitions),
>> or does it not show up at all ?
>
> It shows up as: SANDISK nor drive letter, 28.97 GB FAT 32, Healthy
> (Primary Partition).
>
> When JavaJive and I were working this problem earlier, I had assigned
> X: as it's letter so I assigned it again just now. I then checked my
> file manager and low and behold, there it was!! I have absolutely no
> idea how that happened as I haven't touched that drive for about a
> week now. Computer has been restarted several times and shut down a
> couple, but this is the first time I have plugged that drive in for
> about a week.
>
> Thanks for fixing it for me!! ;-)

My best guess at an explanation, you making the the BitLocker settings
the same on the two PCs.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On Wed, 16 Nov 2022 15:50:58 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 16/11/2022 15:19, jetjock wrote:
>>
>> On Tue, 15 Nov 2022 19:31:42 -0500, Paul <nospam@needed.invalid>
>> wrote:
>>>
>>> When you plug in your USB stick, does a row show up
>>> in Disk Management (with no recognizable partitions),
>>> or does it not show up at all ?
>>
>> It shows up as: SANDISK nor drive letter, 28.97 GB FAT 32, Healthy
>> (Primary Partition).
>>
>> When JavaJive and I were working this problem earlier, I had assigned
>> X: as it's letter so I assigned it again just now. I then checked my
>> file manager and low and behold, there it was!! I have absolutely no
>> idea how that happened as I haven't touched that drive for about a
>> week now. Computer has been restarted several times and shut down a
>> couple, but this is the first time I have plugged that drive in for
>> about a week.
>>
>> Thanks for fixing it for me!! ;-)
>
>My best guess at an explanation, you making the the BitLocker settings
>the same on the two PCs.

That would be logical, but I never changed them. When I checked them,
they were already identical.

>>>>>>>>>>jetjock<<<<<<<<<<

On 16/11/2022 21:50, jetjock wrote:
>
> On Wed, 16 Nov 2022 15:50:58 +0000, Java Jive <java@evij.com.invalid>
> wrote:
>>
>> My best guess at an explanation, you making the the BitLocker settings
>> the same on the two PCs.
>
> That would be logical, but I never changed them. When I checked them,
> they were already identical.

On 09/11/2022 20:41, jetjock wrote:
>
> BDESVC is "Stopped" & "Disabled on my (doesn't work) computer and
> "Stopped" and "Manual" on wife's (works) machine. Neither has ever
> been turned on except yesterday when I turned mine on just to see if
> that would make a difference...it didn't. It's "Stopped" now.

Also ...

On 07/11/2022 17:37, jetjock wrote:
> - <Event
> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> - <System>
> <Provider Name="Microsoft-Windows-BitLocker-Driver"
> Guid="{651DF93B-5053-4D1E-94C5-F6E6D25908D0}" />
> <EventID>24620</EventID>
> <Version>0</Version>
> <Level>2</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x8000000000000000</Keywords>
> <TimeCreated SystemTime="2022-11-07T16:12:57.736444800Z" />
> <EventRecordID>1650171</EventRecordID>
> <Correlation />
> <Execution ProcessID="4" ThreadID="84" />
> <Channel>System</Channel>
> <Computer>MikesDesktop</Computer>
> <Security UserID="S-1-5-18" />
> </System>
> - <EventData>
> <Data Name="ErrorCode">0x80000010</Data>
> <Data Name="Volume" />
> <Data Name="WritePhase">0x0</Data>
> </EventData>
> </Event>

So, although you say that you've never used BitLocker, and I believe
you, at least knowingly, the facts that ...
- We found the BitLocker service was causing an event;
- BitLocker service settings differed between the PCs
when yours didn't work;
+ Now they are the same and yours works as well
.... suggest to me that somehow BitLocker was involved when you first
formatted the SanDisk, and therefore the service needed to be able to
run whenever subsequently you inserted it, even if only momentarily to
decide this particular disk was not encrypted, and it was changing the
BitLocker service settings to allow this to happen that made the
difference, and that the reason why it failed to make a difference the
first time you tried it, as in your reply I just requoted above, was
probably because you didn't reboot after making the change.

But hey! After all, it's just a guess!

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk