LordMike
ExampleHashDrives
I've used the example HashDrives code for hashing complete drives, by setting the lengthTodo = disk.SizeBytes, but it fails against a Kingston 128GB USB drive when trying to access the last sector, with the error "The drive cannot find the sector requested".
The device can be successfully hashed using other tools without issue.
The drive has an odd number of sectors (242,155,521 sectors, 512 bytes per sector (123,983,626,752 bytes)). Could this be causing the problem?
I remember having so many issues with the last sector thing. Are you able to download the source for the library and troubleshoot it that way?
Mike.
From: xtaylord @.> Sent: Friday, May 5, 2023 8:21:21 AM To: LordMike/RawDiskLib @.> Cc: Subscribed @.***> Subject: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I've used the example HashDrives code for hashing complete drives, by setting the lengthTodo = disk.SizeBytes, but it fails against a Kingston 128GB USB drive when trying to access the last sector, with the error "The drive cannot find the sector requested".
The device can be successfully hashed using other tools without issue.
The drive has an odd number of sectors (242,155,521 sectors, 512 bytes per sector (123,983,626,752 bytes)). Could this be causing the problem?
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAH2YJ6HBLRARI4HD7C6QEDXESL6DANCNFSM6AAAAAAXWWDYJA. You are receiving this because you are subscribed to this thread.Message ID: @.***>
Morning Mike,
I'll download the source and see if I can track down the issue
Thanks
From: Michael Bisbjerg @.> Sent: 05 May 2023 07:42 To: LordMike/RawDiskLib @.> Cc: xtaylord @.>; Author @.> Subject: Re: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I remember having so many issues with the last sector thing. Are you able to download the source for the library and troubleshoot it that way?
Mike.
From: xtaylord @.> Sent: Friday, May 5, 2023 8:21:21 AM To: LordMike/RawDiskLib @.> Cc: Subscribed @.***> Subject: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I've used the example HashDrives code for hashing complete drives, by setting the lengthTodo = disk.SizeBytes, but it fails against a Kingston 128GB USB drive when trying to access the last sector, with the error "The drive cannot find the sector requested".
The device can be successfully hashed using other tools without issue.
The drive has an odd number of sectors (242,155,521 sectors, 512 bytes per sector (123,983,626,752 bytes)). Could this be causing the problem?
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAH2YJ6HBLRARI4HD7C6QEDXESL6DANCNFSM6AAAAAAXWWDYJA. You are receiving this because you are subscribed to this thread.Message ID: @.***>
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19#issuecomment-1535787701, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABN3MG5WQ2ZYT4MERMJ466TXESOMPANCNFSM6AAAAAAXWWDYJA. You are receiving this because you authored the thread.Message ID: @.***>
It seems to be an issue with system.io.filestream
Make: Kingston DataTraveler 3.0 USB Device
FTK Imager reports: Sector count: 242,155,521 Bytes per sector: 512 Total capacity: 123,983,626,752 bytes
The exception happens in RawDiskStream.cs:line 80: actualRead = _diskStream.Read(buffer, offset, count); // values: buffer = {byte[16777216]}, offset = 0, count = 512 This occurs when _diskStream.position = 123,983,626,240 (one sector before the end of the disk)
{"The drive cannot find the sector requested."}
'_diskStream.Length' threw an exception of type 'System.IO.IOException'
" at System.IO.FileStream.ReadNative(Span1 buffer)\r\n at System.IO.FileStream.ReadSpan(Span1 destination)\r\n at System.IO.FileStream.Read(Byte[] array, Int32 offset, Int32 count)\r\n at RawDiskLib.RawDiskStream.Read(Byte[] buffer, Int32 offset, Int32 count) in C:\Users\dn\source\repos\RawDiskLib-master\RawDiskLib\RawDiskStream.cs:line 80"
From: Michael Bisbjerg @.> Sent: 05 May 2023 07:42 To: LordMike/RawDiskLib @.> Cc: xtaylord @.>; Author @.> Subject: Re: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I remember having so many issues with the last sector thing. Are you able to download the source for the library and troubleshoot it that way?
Mike.
From: xtaylord @.> Sent: Friday, May 5, 2023 8:21:21 AM To: LordMike/RawDiskLib @.> Cc: Subscribed @.***> Subject: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I've used the example HashDrives code for hashing complete drives, by setting the lengthTodo = disk.SizeBytes, but it fails against a Kingston 128GB USB drive when trying to access the last sector, with the error "The drive cannot find the sector requested".
The device can be successfully hashed using other tools without issue.
The drive has an odd number of sectors (242,155,521 sectors, 512 bytes per sector (123,983,626,752 bytes)). Could this be causing the problem?
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAH2YJ6HBLRARI4HD7C6QEDXESL6DANCNFSM6AAAAAAXWWDYJA. You are receiving this because you are subscribed to this thread.Message ID: @.***>
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19#issuecomment-1535787701, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABN3MG5WQ2ZYT4MERMJ466TXESOMPANCNFSM6AAAAAAXWWDYJA. You are receiving this because you authored the thread.Message ID: @.***>
Seems like windows underlying doesn’t provide access to this sector.
You can use the library to get a handle to the drive, this allows you to interact with it directly. There you can try reading the last bytes and see if it works.
Mike.
From: xtaylord @.> Sent: Friday, May 5, 2023 3:46:55 PM To: LordMike/RawDiskLib @.> Cc: Michael Bisbjerg @.>; Comment @.> Subject: Re: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
It seems to be an issue with system.io.filestream
Make: Kingston DataTraveler 3.0 USB Device
FTK Imager reports: Sector count: 242,155,521 Bytes per sector: 512 Total capacity: 123,983,626,752 bytes
The exception happens in RawDiskStream.cs:line 80: actualRead = _diskStream.Read(buffer, offset, count); // values: buffer = {byte[16777216]}, offset = 0, count = 512 This occurs when _diskStream.position = 123,983,626,240 (one sector before the end of the disk)
{"The drive cannot find the sector requested."}
'_diskStream.Length' threw an exception of type 'System.IO.IOException'
" at System.IO.FileStream.ReadNative(Span1 buffer)\r\n at System.IO.FileStream.ReadSpan(Span1 destination)\r\n at System.IO.FileStream.Read(Byte[] array, Int32 offset, Int32 count)\r\n at RawDiskLib.RawDiskStream.Read(Byte[] buffer, Int32 offset, Int32 count) in C:\Users\dn\source\repos\RawDiskLib-master\RawDiskLib\RawDiskStream.cs:line 80"
From: Michael Bisbjerg @.> Sent: 05 May 2023 07:42 To: LordMike/RawDiskLib @.> Cc: xtaylord @.>; Author @.> Subject: Re: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I remember having so many issues with the last sector thing. Are you able to download the source for the library and troubleshoot it that way?
Mike.
From: xtaylord @.> Sent: Friday, May 5, 2023 8:21:21 AM To: LordMike/RawDiskLib @.> Cc: Subscribed @.***> Subject: [LordMike/RawDiskLib] ExampleHashDrives (Issue #19)
I've used the example HashDrives code for hashing complete drives, by setting the lengthTodo = disk.SizeBytes, but it fails against a Kingston 128GB USB drive when trying to access the last sector, with the error "The drive cannot find the sector requested".
The device can be successfully hashed using other tools without issue.
The drive has an odd number of sectors (242,155,521 sectors, 512 bytes per sector (123,983,626,752 bytes)). Could this be causing the problem?
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAH2YJ6HBLRARI4HD7C6QEDXESL6DANCNFSM6AAAAAAXWWDYJA. You are receiving this because you are subscribed to this thread.Message ID: @.***>
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19#issuecomment-1535787701, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABN3MG5WQ2ZYT4MERMJ466TXESOMPANCNFSM6AAAAAAXWWDYJA. You are receiving this because you authored the thread.Message ID: @.***>
— Reply to this email directly, view it on GitHubhttps://github.com/LordMike/RawDiskLib/issues/19#issuecomment-1536287743, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAH2YJ3O5FEWLFZF6RZ6N2DXEUAE7ANCNFSM6AAAAAAXWWDYJA. You are receiving this because you commented.Message ID: @.***>
I was unable to resolve using filestream, so I switched to importing kernel32.dll and using CreateFile and ReadFile. In my tests, this provides access to all sectors including the last odd sector and I now obtain the correct hash value for the drive when compared to commercial forensic tools.