ImageUSB failing after making a .bin file

[Bazzek]

Version: 1.2.1003
OS: Windows 7, 64 bit
USB drive: Kingston Datatraveler G4 32GB
Volumes: 1 volume on the stick, a bootable FAT32 partition to help with reinstalling windows 7 machines (boots windows install disk and contains all needed software). There is 500MB free space to allow for images to be transfered to new sticks

Problem:
I have imageUSB create an image of my bootable install stick. This runs for quite a while (22GB in data). Once 100% has been reached (verify is off for now so we don't complicate things), it waits for something like 60 seconds and then says FAILED Failed (Drive F:\) with error 2: The system cannot find the file specified.
If i don't use option -d the filesize is 0 at the end. With -d the file seems written.
The file is unreadable in for instance winiso.

The thing is, the USB stick is NOT removed, but after the error the system doesn't see the drive anymore until i reinsert it.

I made sure the disks involved (USB as source and local as destination) got through their disk checking utils.

log ouput:
12:27:54 - PassMark Software - imageUSB v1.2.1003
12:27:54 - Getting list of available removable USB drives...
12:27:54 - Inspecting Drive C:\...
12:27:54 - Drive String \\.\C:
12:27:54 - Drive C:\: Not of USB Type Skipping. (DriveType
12:27:54 - Inspecting Drive D:\...
12:27:54 - Drive String \\.\D:
12:27:54 - Drive D:\: Not of USB Type Skipping. (DriveType
12:27:54 - Inspecting Drive F:\...
12:27:54 - Drive String \\.\F:
12:27:54 - Drive F:\ Size: 30358818816 Bytes Volume: Other: FAT32
12:27:54 - Ready...
12:28:40 - File already exists. D:\Downloads\Win7_Off2010_AdobeCS6.bin (879165952)
12:28:41 - User chose to overwrite existing file (D:\Downloads\Win7_Off2010_AdobeCS6.bin).
12:28:41 - Drive F:\ is Disk No 2
12:28:41 - Drive F:\ added to queue.
12:28:41 - Creating image from Drive F:\ - Image FileName: D:\Downloads\Win7_Off2010_AdobeCS6.bin
12:28:42 - Starting to Create From Drive F:\
12:28:42 - UFD \\.\PhysicalDrive2 size 30943995904 bytes.
12:28:42 - Successfully opened image file D:\Downloads\Win7_Off2010_AdobeCS6.bin for write acess.
12:28:42 - Creating image D:\Downloads\Win7_Off2010_AdobeCS6.bin from F:\ (drive 2)
12:53:38 - Error: Failed to read from UFD at offset 30943477760 (0x34600000).
12:53:38 - Failed (Drive F:\) with error 2: The system cannot find the file specified.





Debug log (imageusb.exe -d):
04-May-2015 - 12:27:54:637 - PassMark Software - imageUSB v1.2.1003
04-May-2015 - 12:27:54:637 - Getting list of available removable USB drives...
04-May-2015 - 12:27:54:637 - Inspecting Drive C:\...
04-May-2015 - 12:27:54:637 - Drive String \\.\C:
04-May-2015 - 12:27:54:637 - Drive C:\: Not of USB Type Skipping. (DriveType
04-May-2015 - 12:27:54:637 - Inspecting Drive D:\...
04-May-2015 - 12:27:54:637 - Drive String \\.\D:
04-May-2015 - 12:27:54:637 - Drive D:\: Not of USB Type Skipping. (DriveType
04-May-2015 - 12:27:54:637 - Inspecting Drive F:\...
04-May-2015 - 12:27:54:637 - Drive String \\.\F:
04-May-2015 - 12:27:54:637 - Drive F:\ Size: 30358818816 Bytes Volume: Other: FAT32
04-May-2015 - 12:27:54:637 - Ready...
04-May-2015 - 12:28:40:170 - File already exists. D:\Downloads\Win7_Off2010_AdobeCS6.bin (879165952)
04-May-2015 - 12:28:41:600 - User chose to overwrite existing file (D:\Downloads\Win7_Off2010_AdobeCS6.bin).
04-May-2015 - 12:28:41:620 - Drive F:\ is Disk No 2
04-May-2015 - 12:28:41:620 - Drive F:\ added to queue.
04-May-2015 - 12:28:41:630 - Creating image from Drive F:\ - Image FileName: D:\Downloads\Win7_Off2010_AdobeCS6.bin
04-May-2015 - 12:28:42:141 - Starting to Create From Drive F:\
04-May-2015 - 12:28:42:141 - UFD \\.\PhysicalDrive2 size 30943995904 bytes.
04-May-2015 - 12:28:42:391 - Successfully opened image file D:\Downloads\Win7_Off2010_AdobeCS6.bin for write acess.
04-May-2015 - 12:28:42:391 - Creating image D:\Downloads\Win7_Off2010_AdobeCS6.bin from F:\ (drive 2)
04-May-2015 - 12:53:38:159 - Error: Failed to read from UFD at offset 30943477760 (0x34600000).
04-May-2015 - 12:53:38:182 - Failed (Drive F:\) with error 2: The system cannot find the file specified.

[Richard (PassMark)]

UFD \\.\PhysicalDrive2 size 30943995904 bytes.
...
Error: Failed to read from UFD at offset 30943477760 (0x34600000).

imageUSB failed to read at location specified in the offset. The drive reports that the size is 30943995904 bytes in size, but when trying to read at location, 30943477760, it failed. You can try to use Raw disk viewer in OSForensics to see if you can actually read from that location on the drive.

[Bazzek]

If i understand how OSForensics works, it seems to be able to read at that location. I cannot judge the content (it should be binary or stale data anyways).

[Bazzek]

Made an image woth OSForenics, no issue whatsoever. At least i have an image now

[Richard (PassMark)]

Glad you got an image made of your drive.

If possible, to see if this is really an issue with imageUSB, would you have another computer available to test it again using imageUSB to see if the same error occurs?

[Bazzek]

Not today, but will sure do and post results.

[mhaverin]

I think I'm having the same problem. I have been trying to read an image of a USB stick with imageUSB V1.2 Build 1003 and been getting the same "Error: Failed to read from UFD at offset 8010072064 (0xdd700000)." message.

I'm on 64-bit Windows 7 Professional, the USB stick is a Kingston DT101 G2 8GB and it has one ext4 partition. I tried two computers and two different USB sticks with the same results. imageUSB V1.1 Build 1015 works on both computers.

Log (imageusb -l -d):
02-heinä-2015 - 14:45:56:583 - PassMark Software - imageUSB v1.2.1003
02-heinä-2015 - 14:45:56:584 - Getting list of available removable USB drives...
02-heinä-2015 - 14:45:56:585 - Inspecting Drive C:\...
02-heinä-2015 - 14:45:56:585 - Drive String \\.\C:
02-heinä-2015 - 14:45:56:585 - Drive C:\: Not of USB Type Skipping. (DriveType 3)
02-heinä-2015 - 14:45:56:585 - Inspecting Drive D:\...
02-heinä-2015 - 14:45:56:586 - Drive String \\.\D:
02-heinä-2015 - 14:45:56:600 - Ready...
02-heinä-2015 - 14:46:39:164 - Drive D:\ is Disk No 1
02-heinä-2015 - 14:46:39:166 - Drive D:\ added to queue.
02-heinä-2015 - 14:46:39:169 - Creating image from Drive D:\ - Image FileName: C:\temp\USBimage.bin
02-heinä-2015 - 14:46:39:669 - Starting to Create From Drive D:\
02-heinä-2015 - 14:46:39:673 - UFD \\.\PhysicalDrive1 size 8010194944 bytes.
02-heinä-2015 - 14:46:39:676 - Successfully opened image file C:\temp\USBimage.bin for write acess.
02-heinä-2015 - 14:46:39:678 - Creating image C:\temp\USBimage.bin from D:\ (drive 1)
02-heinä-2015 - 14:53:04:050 - Error: Failed to read from UFD at offset 8010072064 (0xdd700000).
02-heinä-2015 - 14:53:04:053 - Failed (Drive D:\) with error 1: Incorrect function.

02-heinä-2015 - 14:53:45:788 - Exiting...

[Richard (PassMark)]

02-heinä-2015 - 14:53:04:050 - Error: Failed to read from UFD at offset 8010072064 (0xdd700000).
02-heinä-2015 - 14:53:04:053 - Failed (Drive D:\) with error 1: Incorrect function.

The error code is different from the previous issue (we also never heard back from the previous user). imageUSB uses the ReadFile() function to read from the drive and the error code returned during the image process is Error 1: Incorrect Function. Not an error code we have encountered.

There hasn't been any significant changes in the source code between V1.1.1015 and V1.2.1003 for the create file function either. We do have several Kingston DT101 G2 in the office, and so far our testing has yet to fail.

Doubt there is any way for us to get a hold of your drive? Or can you let us know where you purchased it and we may obtain one ourselves.

[mhaverin]

I did some more testing and so far it seems like that the error occurs only with those Kingston DT101 G2 8G sticks. I managed to read a bunch of 2, 4, 8 and 16 GB sticks from different manufacturers without any problems.

With those Kingstons, the reading error happens regardless of what is on the sticks: I just zeroed the sticks with imageUSB and also at a separate Linux computer with dd and the reading still fails. Writing to the problematic sticks works, though.

I'll see if I can get permission to send you one of the Kingstons giving us problems.

[David (PassMark)]

If you can send them to the US office that would be great.
Contact details are here,
http://www.passmark.com/about/contact_us.htm

It might be that they are just a bad batch of drives.

[mhaverin]

I'll send you one of the drives next week.

[Richard (PassMark)]

I'll send you one of the drives next week.

Sorry for the delay in response, USA office was closed last week. We have received the drive and confirmed the behavior as reported. We traced the issue back to a bug in the software. We should have a fix for it later this week.

[Richard (PassMark)]

V1.2.1004 has been uploaded. Please let us know if the issue still persists, http://www.osforensics.com/tools/write-usb-images.html

Would you like us to return your USB Flash Drive?

[mhaverin]

Sorry for the delay on my part too, I was also on vacation for a couple of weeks. I'll try to test this this week. You can keep the USB drive.

[mhaverin]

I just tested the V1.2.1004 with two DT101 sticks and they both worked fine. Thank you!