Sunday, March 01, 2009

Partition and Disk Management: Part I – Dancing with Diskpart

Sometimes I find myself on a technical issue and end up puzzling it out.

The aftermath finds me overwhelmed with linkage.  Sometimes due to the interrelatedness of the issues, I struggle a bit to get it all organized in a logical manner.

I’m having to “punt” this time and do another multi-part post.

This isn’t intended to be a end-all post series regarding Windows hard disk partitioning, but the deeper I become involved at work with disk-image deployments, whole-disk encryption, and secure data-wiping, I also seem to come back to partition and disk-management.

In the Beginning…

As part of the workplace response to Hurricane Ike smashing into our region some time ago, our disaster response was to obtain and deploy a large number of laptops for mobile data-processing support.

When their need had passed, the laptops were returned and needed to be secure wiped, repartitioned, imaged, and returned to their original owners.

That should have been a fairly easy process.  The only “complication” was that I had to deal with mass-quantities of them.

So to save time, I used my custom Win PE 2.0 boot USB stick, fired up DiskPart.exe (part of the Win2K/XP/Vista System32 components) and planned on following my usual routine:

        1. Diskpart
        2. select disk 0
        3. clean all
        4. create partition primary
        5. select partition 1
        6. active
        7. assign letter = C
        8. exit

Followed up by a final

format C: /fs:ntfs /q /y

And then an ImageX session dumping a sysprepped WIM image on them.

Only this time when I got to step 6 I got the following error:

DISKPART> assign letter = c

DiskPart has encountered an error: The directory is not empty.
See the System Event Log for more information.

I kept going back and forth deleting the partition, re-cleaning the disk, recreating the partitions but got nowhere.  That same crazy error.  I was completely stumped as no data should be on the disk/partition. 

As far as I knew, that “clean all” command should have zero’ed out the disk.

Granted, in the past I normally did only a “clean” command and not a “clean all” but I wanted to zero-out these drives as they were leaving our purview and I wanted to be be sure any confidential customer data was scrubbed and irrecoverable.

I really like using DiskPart for these tasks, even though it is CLI since it is fast and always at hand as part of the WinPE system files.

I had a quick turnaround required on these systems so I just pulled my GParted boot cd, booted each system, made some notes and observations, then used it to successfully recreate my NTFS partitions and move on to the imaging phase.  GParted made it a piece of cake and seemed to care less about any issues I was having in DiskPart with rebuilding the partition information and formatting them in NTFS.

I set the issue aside figuring it must be something strange with Dell system drives and the “clean all” command.

Months later….

Time allowed me last week to go back and try to study this issue some more due to concerns I had noted on the Dell drives related to the GParted work.  More on that in Part II.

I was servicing another laptop and going through the wipe, re-partition, and re-image process when I ran into the error yet again.

This time I had more time (and patience) to try to understand what was going wrong.

Let’s pick up after I had cleaned the sole system hard-drive (Disk 0) following steps 1-3 listed previously.  Note: Disk 1 is my bootable WinPE 2.0 boot USB flash drive, and Disk 2 is a USB portable hard-drive that contains my various system images.  Disk 0 was already selected and the focus (as noted by the asterisk in DISKPART output).

DISKPART> list disk

  Disk ###  Status      Size     Free     Dyn  Gpt
  --------  ----------  -------  -------  ---  ---
* Disk 0    Online        56 GB    56 GB
  Disk 1    Online      7872 MB      0 B
  Disk 2    Online       298 GB      0 B

DISKPART> create partition primary

DiskPart succeeded in creating the specified partition.

DISKPART> active

DiskPart marked the current partition as active.

DISKPART> assign letter = c

DiskPart has encountered an error: The directory is not empty.
See the System Event Log for more information.

DISKPART> select disk 0

Disk 0 is now the selected disk.

DISKPART> select volume 1

Volume 1 is the selected volume.

DISKPART> detail partition

Partition 1
Type  : 06
Hidden: No
Active: Yes

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 1                      RAW    Partition     56 GB  Healthy

DISKPART> select volume

Volume 1 is the selected volume.

DISKPART> detail volume

  Disk ###  Status      Size     Free     Dyn  Gpt
  --------  ----------  -------  -------  ---  ---
* Disk 0    Online        56 GB      0 B

Read-only              : No
Hidden                 : No
No Default Drive Letter: No
Shadow Copy            : No
Dismounted             : No
BitLocker Encrypted    : No

Volume Capacity        :   56 GB
Volume Free Space      :   56 GB

DISKPART> delete volume

DiskPart successfully deleted the volume.

DISKPART> list disk

  Disk ###  Status      Size     Free     Dyn  Gpt
  --------  ----------  -------  -------  ---  ---
* Disk 0    Online        56 GB    56 GB
  Disk 1    Online      7872 MB      0 B
  Disk 2    Online       298 GB      0 B

DISKPART> list partition

There are no partitions on this disk to show.

DISKPART> list volume

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     D                       DVD-ROM         0 B  No Media
  Volume 2     C   USBBOOTSTICK   NTFS   Removable   7872 MB  Healthy
  Volume 3     E   MYIMAGESUSB  NTFS   Partition    298 GB  Healthy

DISKPART> list disk

  Disk ###  Status      Size     Free     Dyn  Gpt
  --------  ----------  -------  -------  ---  ---
* Disk 0    Online        56 GB    56 GB
  Disk 1    Online      7872 MB      0 B
  Disk 2    Online       298 GB      0 B

(At this point I realized what was happening, why the error was happening, and took a very simple action.)

DISKPART> rescan

Please wait while DiskPart scans your configuration...

DiskPart has finished scanning your configuration.

DISKPART> list disk

  Disk ###  Status      Size     Free     Dyn  Gpt
  --------  ----------  -------  -------  ---  ---
  Disk 0    Online        56 GB    56 GB
  Disk 2    Online       298 GB      0 B

DISKPART> select disk 0

Disk 0 is now the selected disk.

DISKPART> create partition primary

DiskPart succeeded in creating the specified partition.

DISKPART> active

DiskPart marked the current partition as active.

DISKPART> assign letter = c

DiskPart successfully assigned the drive letter or mount point.

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>format c: /fs:ntfs /v:system /q /y

The type of the file system is RAW.
The new file system is NTFS.
QuickFormatting 57229M
Creating file system structures.
Format complete.
  58602492 KB total disk space.
  58534964 KB are available.

Mission Accomplished!

The Solution?

I’m embarrassed to confess, but I wasn’t keeping track of my letters.

See, when I made the decision to boot the system from a bootable USB drive, a RAM disk was created "drive X” from which the WinPE system runs.

It also configured the system to recognized the hosting USB drive as drive letter (volume) “C”, the portable USB hard-drive containing my images as drive letter (volume) “E”, and the system’s internal DVD-ROM drive letter (volume) as “D”.

Note another important lesson in working with DiskPart: when you “list volume” it will output all the volumes that it picks up across found disks, but it will not tell you which volume is associated with which disk.  In the output I captured you can see that.  Even though Disk 0 was my focus, when I ran the command, it listed all volumes.  I’m not sure of a good way to work around that except that in my case, all my disks were of different sizes and thus I “knew” which one went with which drive.

By puzzling on that I realized that drive C: was already claimed.  Since I was working on the RAM disk “X” I didn’t have a need (or so I thought) to care about what the other drive letters were.

I could create a primary partition on the system Disk 0, even set it to “active” all I wanted, however, since I already had a volume labeled “C” DiskPart wouldn’t let me, reporting that the (C) directory wasn’t empty, and confusing the fire out of me with the cryptic message, even though my focus disk was Disk 0.

Since I knew that the WinPE OS was running in memory off the RAM disk, my solution was to just yank the USB flash drive out of the system, rescan for drives (so the “C” would show dropped and available for assignment), then set the drive letter for Disk 0 to “C”.

Problem solved.

A simple format command and I was good to go with the image application.

Had I not been previously in a hurry using my USB drive to boot the systems, and used a WinPE bootCD instead, I might not have had this issue.  I need to go back and test that out.

Regardless, lesson learned here was to keep track of your drive/volume letters at all times when working with DiskPart.

Now, on to those notes I had taken regarding the Dell drives…I still had unfinished business with them…

--Claus V.

2 comments:

Manjuc said...

I am running into same problem. Is there any other solution other than physically removing USB drive out of the system?

Claus said...

@ Manjuc - Thanks for commenting!

Yes. I think so. I've done it in the past but didn't make notes.

Basically to do so, I seem to recall you should be able to use the commands in diskpart to select the disk/partition of the current one showing up as "C:"

Then reassign another free letter to it.

Then go back and select the disk/volume that you want to rename as "C:" and do so.

Check out this page for the commands/usage: MS Article ID: 300415 - A Description of the Diskpart Command-Line Utility

and specifically these ones:

remove [[letter=l]/[mount=path]/[all]] [noerr]

Use the remove command to remove a letter or mount point from the current in-focus partition. If you specify the all parameter, all of the current drive letters and mount points are removed. If you do not specify a letter or mount point, the drive letter is removed.

Use this command to change the drive letter that is associated with a removable drive.

The drive letter removal is blocked on the system, boot, or paging volumes. You cannot use this command to remove a drive letter to an OEM partition, any GPT partition with an unrecognized GUID, or any of the special non-data, GPT partitions, such as, the ESP partition.

and

assign [[letter=l]/[mount=path]] [noerr]

Use the assign command to assign a letter or mount point to the current in-focus partition. If you do not specify a drive letter, the next available drive letter is assigned. If the letter or mount point is already in use, an error is generated unless you use the noerr parameter.

You can use this command to change the drive letter that is associated with a removable drive.

The drive letter assignment is blocked on the system, boot, or paging volumes. This command cannot be used to assign a drive letter to an OEM partition or any GPT partition, other than the Msdata partition.

For more examples see MS TechNet - DiskPart Command-Line Options.

This should work in this application as the USB drive is seen by Diskpart as a removable drive, allowing you to rename the letter mappings. It wouldn't let you do so for, say the X:\ RAM drive that the system typically runs under in Win PE.

See if this technique helps instead of removing and then replacing/rescan-ing as you mentioned and I blogged about doing as well....

Cheers!

Claus V.