Drive tools for windows

RemoveDrive can be used with all types of drives. Started with -L it tries to remove the drive in an endless loop until success or until canceled.
As result it shows ‘success’ in green or ‘failed’ in red.
The commandline options are case insensitive, I use the upper case L here to prevent confusions with the digit 1.
Sample: would try to prepare drive U: for safe removal in an endless loop until success.

For drives mounted into NTFS folders the full or relative path of the folder can be used: Used with multislot-cardreaders it would remove the whole reader, regardless of the given slot. For removing a card only, use my EjectMedia tool, see below.

Instead the drive letter one of the drive’s device ID strings can be used. The friendly name can be used as «SanDisk Extreme» or the hardware ID of the USB device, like USB\VID_1234&PID_5678.
Wildcards can be used here. E.g. RemoveDrive *Flash* to remove the first drive with ‘Flash’ in its device name. For drives without a mountpoint any ID string or the device’s «friendly name» (also using wildcards) can be used:

If started with admin privileges or the USBDLM command interface available, then a removed USB drive ends up with problem code 21 and can be reactivated by means of RestartSrDev or UsbDriveInfo.
Without admin privileges or with parameter -47 the device gets code 47 and cannot be reactivated alone, instead its parent device (e.g. a USB hub) must be reactivated.
With some 3rd party USB3 drivers the USB device completely disappears after safe removal instead staying present with a problem code.
Here you can use the parameter -d to remove the drive only which then stays with a problem code.

RemoveDrive can be started from the drive to remove. Because a running EXE on a drive prevents a drive being prepared for safe removal it creates a temporary, self deleting copy and starts it with the same parameters. The returned errorlevel is 4 then. To be drive letter independent, use . instead a drive letter. The current drive is removed then. To remove the drive of the RemoveDrive.exe use \ as drive.

If the removal fails then someone still accesses the drive. This can be something obvious like an open Word document or a mounted TrueCrypt container or some kind of monitoring tool like a virus scanner. A network share on the drive that has been used makes the removal fail too.
Started with parameter -h RemoveDrive tries to show open handles on the drive to remove and with -a it activates windows of processes which hold open handles.
But it doesn’t always find all handles. By means of the SysInternals ProcessExplorer you might be able to find more. After starting it go to ‘Find’ -> ‘Find Handle or DLL’, enter the drive letter like X:\ or a part of the kernel-name like ‘Harddisk3’ and search.

When started with parameter -L and the removal failed then the E key can be pressed to perform a media eject after locking and dismounting the volume.
It depends on the device if ejecting the media is supported or not. But the important part is to lock and dismount the volume. If locking succeeds the there where no open handles on the volume. If locking fails then dismounting can be forced by pressing the F key. Then at least the file system is dismounted and in a consitent state, the device can be removed ‘safely enough’.

Since V3.3 the safe removal can be forced, either by giving parameter -f or -l and pressing the F key when asked for.
The author of HotSwap!, Kazuyuki Nakayama told me how: Setting the «Offline» attribute for the disk devices removes all the disk’s volumes and stops all handles to disk and volumes blocking the safe removal. This function is supported since Windows Vista.

Download latest release: removedrive.zip
V2.5 for Windows 2000: removedrive2500.zip

Last update: 30 April 2020

For programmers I’ve made a demo project which shows the essentials:
How to prepare a USB drive for safe removal

A free alternative to the Windows tray icon is «HotSwap!»:
http://mt-naka.com/hotswap/index_enu.htm

Admin rights are required (or an active USBDLM command interface).

0 — successfully restarted at least one device
1 — no device restarted
2 — other problem

After using the Windows «Safely Remove Hardware» facility, a device gets the problem code 47, which is a constant from the cfg.h: CM_PROB_HELD_FOR_EJECT.

As far as known, a device with this problem code cannot be reactivated. The only way for a USB device is to restart the hub which this device is attached to. This can be a root hub or a standard hub. But of course this will restart all devices attached to this hub. Therefore RestartSrDev performs the restart of the parent devices only if the device to reactivation is the only one attached there or the parmeter -f (force) is set.

But sometimes devices have problem code 21 after the safe removal, which is CM_PROB_WILL_BE_REMOVED. Devices with this problem code can be reactivated by restarting them. This can be done by means of the Microsoft DEVCON tool (DEVCON restart DeviceInstanceID). My tool restarts only devices with the problem code 21 or 47, so usually you can just start it with a asterisk as paramerter to restart all devices with code 21.

It seems that it depends on the API call which is used to perform the safe removal. There are two:
CM_Query_And_Remove_SubTree and CM_Request_Device_Eject.
CM_Query_And_Remove_SubTree leads to «Code 21» while CM_Request_Device_Eject leads to «Code 47».
Obviousely the removal is not complete with Code 21, but since drive and volume are gone then it should be «safe» enough.

CM_Query_And_Remove_SubTree requires admin privileges while CM_Request_Device_Eject works for restricted users too.
The Windows Safe Removal leads to Code 47, so probably it uses CM_Request_Device_Eject.

My tool RemoveDrive tries CM_Query_And_Remove_SubTree first and if this fails then it tries CM_Request_Device_Eject.

So, if you have admin privileges (or a USBDLM V4.8 with activated command interface) and removing a drive by means of RemoveDrive, then it is possible to reactivate the drive by means of RestartSrDev.

Code 47 devices can be reactivated by restarting their parent device (e.g. a USB hub) or (since V3.0) by restarting the device’s USB port, which works under XP, Windows 8 and 10 with the Microsoft standard USB drivers.

Last update: 21 June 2020

Under XP this is not allowed for restricted users but this can be enabled by a policy. As RemoveDrive, EjectMedia can be started from the drive to remove.

Last update: 21 April 2020

Last update: 4 Jan 2018

• can identify the TrueCrypt volume by its container
• can loop until success and offers forcing the ejection by pressing F
• can show open handles
• does (in contrast to VeraCrypt) not wake up sleeping drives

I used the term ‘eject’ because under Windows the term ‘dismount’ (as used by the original tool) means only to disconnect the file system but keeping the volume present. If you object that this is the case for eject too then you are right. Remove or release would have been better terms. It can be started from the volume to eject, it creates a temporary copy then. Samples: Returns errorlevels:
0 — success
1 — success by force
2 — TC volume gone while trying
3 — TC volume not removed
4 — 2nd instance started
5 — invalid params

Last update: 8 March 2018

A graphical alternative for quickly changing mount points is UsbDriveInfo, started with admin privileges you can right-click a volume and select «Drive Letter». The tool shows Non-USB drives too if this is activated in the Options menu.

Last update: 09 March 2019

The Sysinternals sync tool can flush volumes only which have a drive letter. And it forgets drive Z: when called without parameters.

Sleeping drives are skipped unless -f is given. VHD, TrueCrpyt and VeraCrypt volumes are resolved to their physical drives to check for being at sleep, other file hosted volumes are not, so unwanted disk wakeups might happen. Flushing and purging a volume’s cache requires admin privileges, so, restricted users cannot do that.
To overcome this limitation I have given the «USB Drive Letter Manager (USBDLM)» V4.8 a command interface which FFB can use for flushing the file cache.
See USBDLM help in section «Settings» for details.

Last update: 10 December 2017

Admin previlegs are required or (under Windows 7 and higher) USBDLM V5.4.6+ with CommandInterface 0x100 active.
The posibility to attach a VHD without admin previleges was the reason to create this tool, otherwise there are Windows diskspart, powershell and vMount: http://reboot.pro/files/file/477-vmount

Last update: 31 December 2019

Under x64 editions of Windows only the included x64 version works.

Admin privileges are required for actual cleanup, without it requests to switch into the test mode.

Since V1.0 it removes non-USB drives if they have a removal policy > 1 (EXPECT_ORDERLY_REMOVAL or EXPECT_SURPRISE_REMOVAL).

When started standalone it waits for a keystroke at the end. This can be skipped by param -n or by starting it minimized or hidden.

Last update: 10 May 2020

Sample for removing X: Since V0.4 in can delete any type of DOS-device, e.g. a serial port as «COM10».

Last update: 19 Feb 2012

It is a non interactive, invisible Windows application. It does the same as Microsoft’s tool DEVCON when called with parameter ‘rescan’, but no console window pops up.

Sample: Disable SystemRestore on drive D: Sample: Disable SystemRestore on drives D: to Z: SRE enables the XP SystemRestore on certain drives.

If the SystemRestore is enabled or disabled for the system drive then this is done of all other local drives too!

This tool is for XP only. W2K has no system restore and since Vista the SystemRestore deals with the system drive only.

AutoRun can be disabled depending on the drive type and depending on the drive letter by Explorer Policies.
These values are
— NoDriveAutoRun
and
— NoDriveTypeAutoRun

They are valid under HKEY_LOCAL_MACHINE and under HKEY_CURRENT_USER. If a value exist under HKEY_LOCAL_MACHINE then the same value under HKEY_CURRENT_USER is ignored.
Microsoft TweakUI sets the values under HKEY_CURRENT_USER only and completely ignores HKEY_LOCAL_MACHINE. Furthermore TweakUI cannot make settings for hard drives and it enables AutoRun for network drives by completly ignoring the default values.

For AutoRun and AutoPlay to work the service «Shell Hardware Detection» (ShellHWDetection) is required. If AutoRun is deactivated by the above settings then keeping this service running is in vain under XP unless autoruns for non drive devices are required. Under Vista and Windows 7/8/10 the WIA service relies on it.

These settings have effect only for the moment when a drive is attached. They do not deactivate AutoRun when the drive is opened manually in the Windows Explorer. This is changend with the Microsoft XP Patch KB950582, availlable since August 2008, see here:
http://support.microsoft.com/kb/953252
Since end of February 2009 it is automatically distrbuted as KB967715.

An alternative is to completely disable the autorun.inf mechanisms as suggested by the US-CERT. This prevents the Windows behaviour beeing changed by an autorun.inf file but the selection dialog is still working.

Another setting for CDROM drives is the value «AutoRun» under HKLM\SYSTEM\CurrentControlSet\Services\Cdrom. Despite the name it controls the ‘Auto Insert Notification’, also called ‘Media Change Notification (MCN)’. When deactivated media changes are not detected, therefore AutoRun does not work. But this is a side effect only. This should stay activated. Microsoft says «Do not disable the MCN message unless you have no alternative». One reason to deactivate this is a cyclic flashing HDD-LED which happens on some computers with MCN enabled.

For changing system global settings administrator privileges are required. So under Vista and Windows 7/8/10 you have to right click AutoRunSettings in the Explorer and select «Start as administrator» or create a link to it with this setting.

Screenshot (AutoRun completely deactivated):

Last update: Dec 2010

Last update: 12.2.2010

The Hotfix documentation states that the value must be «between 65535 (64 KB) and 2097120 (2 MB)». But these values are unusual for a data transfer buffer, here multiples of a physical page (4096) make sense and indeed I got an instant blue screen when using 2 Ч 65535 = 131070. Therefore the tool uses 65536 (64 KiB) to 2097152 (2 MiB).

Источник