Everything prevents TrueCrypt from unmounting volumes?

Great Gatsby · Post by **Great Gatsby** » Sun Oct 18, 2009 1:14 pm

I would like to report a problem involving Everything and TrueCrypt: Whenever I try to unmount a TrueCrypt volume, TrueCrypt tells me it is unable to unmount due to a third-party app still accessing the drive, and I have to force the unmount process. I assume this is caused by Everything, because when I kill the process Everything.exe within the Windows task manager, the problem is gone and I can normally unmount the volume.

Post by **David** » Sun Oct 18, 2009 8:51 pm

Please try http://www.voidtools.com/Everything-1.2.1.436a.zip

Great Gatsby · Post by **Great Gatsby** » Sun Oct 18, 2009 10:16 pm

Downloaded the beta and copied the file to Everything's folder, stopped existing Everything.exe, started the new Everything beta, mounted a TrueCrypt volume and unmounted it flawlessly - without any warning by TrueCrypt about apps still accessing the volume. - Thank you very much!

Great Gatsby · Post by **Great Gatsby** » Sat Nov 21, 2009 9:44 pm

Unfortunately, the problem has re-appeared. I cannot say whether it's due to the current Everything beta 1.2.1.446a or actually the new TrueCrypt release 6.3 I've been upgrading to.

Post by **David** » Sun Nov 22, 2009 2:00 am

Thanks for bringing this to my attention.
"Everything" is holding a handle to the volume again.. I will release a fix asap.

Great Gatsby · Post by **Great Gatsby** » Sat Nov 28, 2009 10:24 am

David wrote:Thanks for bringing this to my attention.
"Everything" is holding a handle to the volume again.. I will release a fix asap.

Thank you very much! The new build solved the problem again.

Great Gatsby · Post by **Great Gatsby** » Fri Dec 18, 2009 8:43 pm

Unfortunately, the bug seems to return after a few minutes of volume usage: When I try to unmount my TrueCrypt volume at the end of work, I still get the 'force unmount?'-error message. When I quit Everything after that, the volume will unmount correctly on a second try.

ardee · Post by **ardee** » Sat Sep 08, 2012 8:41 pm

Unfortunately, I have a similar problem with v1.2.1.451a. In general it often prevents the unmounting of some (but not all) external volumes, even ones that don't use TrueCrypt, but particularly those that do (even after dismounting those volumes in TrueCrypt). The external volumes I use are connected via eSATA, in Windows 7, if that helps. Also, four of them are in a single Rosewill enclosure that connects via a single eSATA cable.

I use "USB Safely Remove"(safelyremove.com) instead of Windows' built-in unmounter, as it has always worked a lot easier/better.

Ethan · Post by **Ethan** » Sun Oct 11, 2015 4:49 pm

This problem still happens in 1.4.0.705b.

Post by **void** » Mon Oct 12, 2015 4:57 am

This is a known issue, I spent a bit of time before the beta release trying to get this to work but couldn't find a simple solution.

From memory..
When running Everything with the Everything service, the Everything service never receives the dismount request because TrueCrypt does not send service notifications.
When running Everything as an administrator, Everything will never see the dismount request due to elevation.

Running Everything and TrueCrypt as admin should fix the issue, but this is not recommended.

On my TODO list:
What I need to do is when running Everything with the Everything Service is use the search client to detect dismount requests and pass them to the Everything Service..

Ethan · Post by **Ethan** » Mon Oct 12, 2015 5:24 am

I see. Maybe it could be solved by asking Veracrypt* developers to send dismount notifications, or at least read this topic so you can discuss a solution together?

* = I say Veracrypt because that's what I'm using now, since Truecrypt isn't actively developed anymore.

Post by **void** » Tue Oct 13, 2015 4:13 am

If possible, Veracrypt would need to support SERVICE_CONTROL_DEVICEEVENT for device removal requests and/or broadcasting WM_DEVICECHANGE to elevated Windows (again if possible).

On my TODO list:
What I need to do is when running Everything with the Everything Service is use the search client to detect dismount requests and pass them to the Everything Service..

I'll be looking into this more while I am still beta.

Post by **void** » Wed Oct 28, 2015 9:08 am

I've improved support for Veracrypt in Everything 1.4.0.709b.

The Everything client will now pass on Veracrypts WM_DEVICECHANGE to the Everything service.
Also veracrypt drives are now correctly indexed.

Ethan · Post by **Ethan** » Sun Nov 08, 2015 2:48 pm

Sorry for the late reply. 1.4.0.709b doesn't seem to work properly.

I'm working on Windows 8.1 x64. Everything doesn't scan the system drive, but manages to scan other external drives. Also, it still prevents from dismounting VeraCrypt volumes.
From a limited account I start the service with

Code: Select all

Everything -svc

The -debug -verbose output is the following:

Code: Select all

Everything
Version 1.4.0.709b (x64)
Windows NT 6.2
Processors 4
IsAdmin 1
AppData 0
Service 0
StartServiceCtrlDispatcher Everything
_service_server_main
awake
SecurityDescriptor D:(A;OICI;GRGW;;;AU)
createnamedpipe \\.\PIPE\Everything Service
connect...
sleep 2 0

Then I start the client. The -debug -verbose output is:

Code: Select all

Everything
Version 1.4.0.709b (x64)
Windows NT 6.2
Processors 4
IsAdmin 0
AppData 0
Service 0
create mutex
default font MS Shell Dlg 2 -11
load everything icon
bookmarks
set hook
create tray
db_load
VEH 2681888
volume \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963}: drive type 3
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName C:
add volume: \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963} | C: |
volume \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}: drive type 3
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName Y:
add volume: \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59} | Y: |
volume \\?\Volume{963a7740-57cd-11e5-8265-7429afdfca59}: drive type 3
GetVolumePathNamesForVolumeName 234
volume \\?\Volume{963a777e-57cd-11e5-8265-7429afdfca59}: drive type 2
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName Z:
volume \\?\Volume{963a767e-57cd-11e5-8265-806e6f6e6963}: drive type 5
QueryDosDevice C: \Device\HarddiskVolume1
QueryDosDevice D: \Device\CdRom0
QueryDosDevice Y: \Device\HarddiskVolume2
QueryDosDevice Z: \Device\VeraCryptVolumeZ:
ntfs volume create list 0.004864 seconds
create thread
new thread (0)
loaded db in 0.001189 seconds
13 24
WM_ACTIVATE 0000000000000001 0000000000000000, lastfocus 0000000000000000, curre
nt focus 0000000000000000
cached oneclickactivate 0
enter setfocus
leave setfocus
get sort 0 0
invalidate
enter main loop
MSG: 0000000000130f8c c249 0000000000000000 0000000000000000
MSG: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 00000001400170f0 000000000028dc70
DB_WAIT: _db_load_complete_proc waiting...
DB_WAIT: _db_load_complete_proc waited 0.000212 seconds
start all monitors (ntfs: 0 refs: 0)
create db...
VEH 2884240
volume \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963}: drive type 3
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName C:
add volume: \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963} | C: |
volume \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}: drive type 3
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName Y:
add volume: \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59} | Y: |
volume \\?\Volume{963a7740-57cd-11e5-8265-7429afdfca59}: drive type 3
GetVolumePathNamesForVolumeName 234
volume \\?\Volume{963a777e-57cd-11e5-8265-7429afdfca59}: drive type 2
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName Z:
volume \\?\Volume{963a767e-57cd-11e5-8265-806e6f6e6963}: drive type 5
QueryDosDevice C: \Device\HarddiskVolume1
QueryDosDevice D: \Device\CdRom0
QueryDosDevice Y: \Device\HarddiskVolume2
QueryDosDevice Z: \Device\VeraCryptVolumeZ:
ntfs volume create list 0.007028 seconds
create thread
EVENT: 000000014004cb30 00000000002bfda0
Indexing \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963}, C:,
open volume \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963}
EVENT: 000000014004cae0 00000000002bfda0
CreateFileW(): GetLastError(): 5: Failed to open volume \\?\Volume{963a7676-57cd
-11e5-8265-806e6f6e6963}
opened -1 0.000849
new results
set is access denied
EVENT: 0000000140056d10 00000000002bfda0
Indexing \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}, Y:,
open volume \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}
EVENT: 000000014004cb30 00000000002bfda0
opened 608 0.000269
EVENT: 000000014004cb30 00000000002bfda0
EVENT: 000000014004cae0 00000000002bfda0
sector size 512
new results
mft_lcn 49152
serial_number 11553285560353413124
bytes_per_cluster 65536
bytes_per_file_record 1024
MSG: 00000000001611fa 031f 0000000000000001 0000000000000000
MSG: 00000000001611fa 0402 0000000000000000 0000000000000000
MFT type FILE
MSG: 00000000001611fa c150 0000000000000000 0000000000000000
MFT USA Offset 48
MFT USA Count 3
MFT lsn 0
MFT sequence_number 1
MFT name_count 1
MFT attribute_offset 56
MFT flags 1
MFT bytes_in_use 408
MFT bytes_allocated 1024
MFT base_frn 0
MFT next_attribute_number 10
        TypeCode 00000010
MSG: 0000000000130f8c 0402 0000000000000000 0000000000000000
        MFT record_length 96
        MFT flags 0
EVENT: 000000014004cb30 00000000002bfda0
        MFT name_length 0
        MFT name_offset 24
EVENT: 000000014004cb30 00000000002bfda0
MSG: 0000000000130f8c 0402 0000000000000000 0000000000000000
        MFT form flags 0
        MFT attribute_id 0
        -----------
MSG: 0000000000130f8c 0402 0000000000000000 0000000000000000
MSG: 00000000001611fa 0402 0000000000000000 0000000000000000
        TypeCode 00000030
        MFT record_length 104
        MFT flags 0
        MFT name_length 0
        MFT name_offset 24
        MFT form flags 0
        MFT attribute_id 3
        -----------
        TypeCode 00000080
        MFT record_length 72
        MFT flags 0
        MFT name_length 0
        MFT name_offset 64
        MFT form flags 1
        MFT attribute_id 9
        MFT allocated_length 131072
        MFT file_size 131072
        MFT highest_vcn 1
        MFT lowest_vcn 0
        MFT mapping_pairs_offset 64
        MFT compression_unit_size 0
        MFT total_allocated 3221226033
        MFT valid_data_length 131072
MSG: 0000000000130eae 0200 0000000000000000 00000000013802ba
        remaining MFT Entries 128
        data run offset 64
        -----------
        TypeCode 000000b0
        MFT record_length 72
        MFT flags 0
        MFT name_length 0
        MFT name_offset 64
        MFT form flags 1
        MFT attribute_id 8
        -----------
        TypeCode ffffffff
data run array count 1
MSG: 0000000000130eae 000f 0000000000000000 0000000000000000
found data run with vcn 0
mapping pair len size 1
mapping pair offset size 3
mapping pair cluster offset: 49152, cluster count: 2, record count: 128 run: 128

ignore name attr for internal ntfs folder 000000000000000b
ignore name attr for internal ntfs folder 000000000000000b
ignore name attr for internal ntfs folder 000000000000000b
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
bad file record type 44414142
ignore name attr for internal ntfs folder 000000000000000b
ignore name attr for internal ntfs folder 000000000000000b
bad file record type 44414142
bad file record type 44414142
bad file record type f470289f
bad file record type 30261338
bad file record type 6d1cc920
bad file record type 22425b77
bad file record type ae73ce3b
bad file record type dc2f64e9
bad file record type e5ec59b9
bad file record type 39b23dc4
bad file record type 2fcd77e9
bad file record type c8bde910
bad file record type b4d00248
bad file record type be9e0675
bad file record type 7a742331
bad file record type 488b6540
bad file record type 2d462f0c
bad file record type 4f2cb47a
bad file record type 41aaba1e
bad file record type 2ddac5aa
bad file record type b1e2f8f1
bad file record type 9f016019
bad file record type 0d8b04b7
bad file record type 7b738bea
bad file record type 959b2113
bad file record type dce6962e
bad file record type a1a76cbe
bad file record type d42baf30
bad file record type c70b28f9
bad file record type 96bd0790
data run array count 0
left over count 0
processed 128 / 128 file records
base_fragmented_record_count 0
0.042304 seconds
convert parent frn to parent pointers: 0.000001 seconds
excluded folder: $TxfLog
excluded folder: $Txf
MSG: 0000000000130f8c 0402 0000000000000000 0000000000000000
null parent file: $Repair
excluded file: $Tops
excluded file: $TxfLog.blf
excluded file: $TxfLogContainer00000000000000000001
excluded file: $TxfLogContainer00000000000000000002
EVENT: 000000014004cb30 00000000002bfda0
removed 5 orphaned files in 0.001324 seconds
removed 2 orphaned folders in 0.000002 seconds
EVENT: 000000014004cb30 00000000002bfda0
folder name os_qsort: 0.000002 seconds
EVENT: 000000014004cb30 00000000002bfda0
EVENT: 000000014004cb30 00000000002bfda0
os_qsort file names indexes: 0.000026 seconds
_db_index_add 0: 0, 00000000002755e0
EVENT: 000000014004cb30 00000000002bfda0
EVENT: 000000014004cb30 00000000002bfda0
_db_index_add 1: 0, 0000000000275500
MSG: 00000000001611fa 0402 0000000000000000 0000000000000000
setup file systems: 0.000934 seconds
setup files: 0.000008 seconds
setup folders: 0.000191 seconds
create db time taken: 0.053639 seconds
add monitors
create ntfs monitor Y:
loaded 0 of 0 changes in 0.000006 seconds
recent changes array memory usage: 0 bytes
loaded run history in 0.000090 seconds
run history data count: 0, data: 0 bytes
run history ptr count: 0
total run history memory usage: 0 bytes
success
MSG: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 00000001400170f0 000000000028dc70
DB_WAIT: _db_load_complete_proc waiting...
DB_WAIT: _db_load_complete_proc waited 0.000209 seconds
start all monitors (ntfs: 1 refs: 0)
open volume \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}
opened 608 0.000268
ntfs monitor 000000000029c470 0000000000000260
create thread
open volume \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}
add volume: \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963} | C: |
opened 604 0.000320
add volume: \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59} | Y: |
WAIT 0, 2 waits
VEH 3366496
volume \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963}: drive type 3
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName C:
volume \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59}: drive type 3
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName Y:
volume \\?\Volume{963a7740-57cd-11e5-8265-7429afdfca59}: drive type 3
GetVolumePathNamesForVolumeName 234
volume \\?\Volume{963a777e-57cd-11e5-8265-7429afdfca59}: drive type 2
GetVolumePathNamesForVolumeName 234
GetVolumePathNamesForVolumeName Z:
volume \\?\Volume{963a767e-57cd-11e5-8265-806e6f6e6963}: drive type 5
QueryDosDevice C: \Device\HarddiskVolume1
QueryDosDevice D: \Device\CdRom0
QueryDosDevice Y: \Device\HarddiskVolume2
QueryDosDevice Z: \Device\VeraCryptVolumeZ:
ntfs volume create list 0.008780 seconds
cmp guid \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963} \\?\Volume{963a7676-57
cd-11e5-8265-806e6f6e6963} = 0
cmp guid \\?\Volume{963a773f-57cd-11e5-8265-7429afdfca59} \\?\Volume{963a773f-57
cd-11e5-8265-7429afdfca59} = 0
open volume \\?\Volume{963a7676-57cd-11e5-8265-806e6f6e6963}
CreateFileW(): GetLastError(): 5: Failed to open volume \\?\Volume{963a7676-57cd
-11e5-8265-806e6f6e6963}
opened -1 0.000515
set is access denied
is out of date volume available C:: 1306696
check for file list changes
checked for file list changes in 0.000213 seconds
search '' filter '' sort 0
term 0000000000313270, flags: 3140, next: 0000000000000000, notnext: 00000000000
00000
folderop: 0, fileop: 0, term:
create thread
new thread (1)
EVENT: 000000014004cb30 00000000002bfda0
SET SORT 0
EVENT: 00000001400179f0 000000000028dc70
EVENT: 000000014004cb30 00000000002bfda0
EVENT: 0000000140056c80 00000000002bfda0
EVENT: 000000014004cb30 00000000002bfda0
found 8 folders, size 4104, db search time taken: 0.000002 seconds
MSG: 00000000001611fa 0402 0000000000000000 0000000000000000
found 17 files, size 4104, db search time taken: 0.000004 seconds
set sort 0 1
already sorted
finished sort, time taken 0.003428 seconds
update selection 0.000001 seconds
WM_ACTIVATE 0000000000000000 00000000001210d2, lastfocus 0000000000161102, curre
nt focus 0000000000161102
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cae0 00000000002bfda0
EVENT: 000000014004cb30 00000000002bfda0
DB_WAIT: db_get_selection_count waiting...
DB_WAIT: db_get_selection_count waited 0.000344 seconds
EVENT: 00000001400179f0 000000000028dc70
EVENT: 000000014004cae0 00000000002bfda0
new results
EVENT: 0000000140056ca0 00000000002bfda0
MSGFILTER: 00000000001210d2 031f 0000000000000001 0000000000000000
MSGFILTER: 00000000001611fa 0402 0000000000000000 0000000000000000
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
MSGFILTER: 0000000000161102 000f 0000000000000000 0000000000000000
MSGFILTER: 0000000000130eae 02a3 0000000000000000 0000000000000000
MSGFILTER: 0000000000130eae 000f 0000000000000000 0000000000000000
create thread
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130eae 000f 0000000000000000 0000000000000000
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130eae 000f 0000000000000000 0000000000000000
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130eae 000f 0000000000000000 0000000000000000
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130eae 000f 0000000000000000 0000000000000000
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000130f8c 0402 0000000000000000 0000000000000000
EVENT: 000000014004cb50 00000000002bfda0
EVENT: 000000014004cb50 00000000002bfda0
MSGFILTER: 0000000000120fbc 0113 0000000000000001 0000000000000000
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000000000 0113 0000000000000a4d 00007ff9cb0a2b10
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000000000 0113 0000000000000a48 00007ff9cb0a2b10
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000000000 0113 0000000000000a44 00007ff9cb0a2b10
MSGFILTER: 00000000001210d2 00a0 0000000000000012 0000000001e9029a
MSGFILTER: 00000000001210d2 00a0 0000000000000012 0000000001e90299
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000ae0179
MSGFILTER: 00000000001210d2 02a2 0000000000000000 0000000000000000
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000ae0178
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000ae0177
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000af0174
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000b00173
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000b00170
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000b0016f
MSGFILTER: 00000000001210d2 0200 0000000000000000 0000000000b1016e
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000030049
MSGFILTER: 00000000001011e8 000f 0000000000000000 0000000000000000
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000040049
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000040048
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000040047
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000040045
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000040044
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000050043
MSGFILTER: 00000000001011e8 0113 0000000001cf80d0 00007ff9cb127f90
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000050042
MSGFILTER: 00000000001011e8 0200 0000000000000000 000000000007003f
MSGFILTER: 00000000001011e8 0200 0000000000000000 000000000008003e
MSGFILTER: 00000000001011e8 0200 0000000000000000 000000000008003c
MSGFILTER: 00000000001011e8 0200 0000000000000000 000000000009003b
MSGFILTER: 00000000001011e8 0113 0000000001cf80d0 00007ff9cb127f90
MSGFILTER: 00000000001011e8 0200 0000000000000000 000000000009003a
MSGFILTER: 00000000001011e8 0200 0000000000000000 0000000000090038
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000a0038
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000a0036
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000b0035
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000b0033
MSGFILTER: 00000000001011e8 0113 0000000001cf80d0 00007ff9cb127f90
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000c0031
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000c0030
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000c002f
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000d002f
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000d002d
MSGFILTER: 00000000001011e8 0113 0000000001cf80d0 00007ff9cb127f90
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000d002c
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000d002a
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000d0029
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000f0028
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000f0027
MSGFILTER: 00000000001011e8 0200 0000000000000000 00000000000f0026
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000130eae 0113 000000000000002d 0000000000000000
MSGFILTER: 0000000000000000 0113 0000000000000a40 00007ff9cb0a2b10
MSGFILTER: 00000000001011e8 0201 0000000000000001 00000000000f0026
MSGFILTER: 00000000001011e8 000f 0000000000000000 0000000000000000
MSGFILTER: 00000000000f0dbe 000f 0000000000000000 0000000000000000
MSGFILTER: 00000000001011e8 0202 0000000000000000 00000000000f0026
WM_ACTIVATE 0000000000000001 00000000001210d2, lastfocus 0000000000161102, curre
nt focus 00000000001210d2
MSG: 0000000000130eae 0200 0000000000000000 00000000015e0211
MSG: 0000000000161102 000f 0000000000000000 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000120fbc 0113 0000000000000001 0000000000000000
MSG: 0000000000130eae 0200 0000000000000000 00000000015e0210
MSG: 0000000000130eae 0200 0000000000000000 00000000015e020d
MSG: 0000000000130eae 0200 0000000000000000 00000000015d020c
MSG: 0000000000130eae 0200 0000000000000000 00000000015d020b
MSG: 0000000000130eae 0200 0000000000000000 00000000015c020a
MSG: 0000000000130eae 0200 0000000000000000 00000000015c0209
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0200 0000000000000000 00000000015b0208
MSG: 0000000000130eae 0200 0000000000000000 00000000015a0204
MSG: 0000000000161102 0118 000000000000ffff fffff960001e2670
MSG: 0000000000130eae 0200 0000000000000000 0000000001590203
MSG: 0000000000130eae 0200 0000000000000000 0000000001560201
MSG: 0000000000130eae 0200 0000000000000000 00000000015101fb
MSG: 0000000000130eae 0200 0000000000000000 00000000015001f8
MSG: 0000000000130eae 0200 0000000000000000 00000000014701ef
MSG: 0000000000130eae 0200 0000000000000000 00000000014401ec
MSG: 0000000000130eae 0200 0000000000000000 00000000014001e8
MSG: 0000000000130eae 0200 0000000000000000 00000000013601de
MSG: 0000000000130eae 0200 0000000000000000 00000000013101d9
MSG: 0000000000130eae 0200 0000000000000000 00000000012c01d2
MSG: 0000000000130eae 0200 0000000000000000 00000000012001c8
MSG: 0000000000130eae 0200 0000000000000000 00000000011b01c3
MSG: 0000000000130eae 0200 0000000000000000 00000000011401be
MSG: 0000000000130eae 0200 0000000000000000 00000000010501b4
MSG: 0000000000130eae 0200 0000000000000000 0000000000fe01ae
MSG: 0000000000130eae 0200 0000000000000000 0000000000ed01a6
MSG: 0000000000130eae 0200 0000000000000000 0000000000e601a1
MSG: 0000000000130eae 0200 0000000000000000 0000000000e2019e
MSG: 0000000000130eae 0200 0000000000000000 0000000000d30194
MSG: 0000000000130eae 0200 0000000000000000 0000000000cc018f
MSG: 0000000000130eae 0200 0000000000000000 0000000000c7018c
MSG: 0000000000130eae 0200 0000000000000000 0000000000b80183
MSG: 0000000000130eae 0200 0000000000000000 0000000000b1017d
MSG: 0000000000130eae 0200 0000000000000000 0000000000ad017a
MSG: 0000000000130eae 0200 0000000000000000 00000000009e0171
MSG: 0000000000130eae 0200 0000000000000000 000000000097016e
MSG: 0000000000130eae 0200 0000000000000000 0000000000860165
MSG: 0000000000130eae 0200 0000000000000000 00000000007f0160
MSG: 0000000000130eae 0200 0000000000000000 000000000079015d
MSG: 0000000000130eae 0200 0000000000000000 00000000006a0154
MSG: 0000000000130eae 0200 0000000000000000 000000000063014f
MSG: 0000000000130eae 0200 0000000000000000 00000000005d014c
MSG: 0000000000130eae 0200 0000000000000000 0000000000510144
MSG: 0000000000130eae 0200 0000000000000000 00000000004a013f
MSG: 0000000000130eae 0200 0000000000000000 000000000045013c
MSG: 0000000000130eae 0200 0000000000000000 00000000003c0137
MSG: 0000000000130eae 0200 0000000000000000 0000000000380134
MSG: 0000000000130eae 0200 0000000000000000 000000000031012f
MSG: 0000000000130eae 0200 0000000000000000 00000000002d012c
MSG: 0000000000130eae 0200 0000000000000000 00000000002a012a
MSG: 0000000000130eae 0200 0000000000000000 0000000000240125
MSG: 0000000000130eae 0200 0000000000000000 00000000001f0122
MSG: 0000000000130eae 0200 0000000000000000 00000000001c0121
MSG: 00000000000d11cc 0200 0000000000000000 000000000016011e
MSG: 00000000000d11cc 0200 0000000000000000 000000000016011e
MSG: 00000000000d11cc 000f 0000000000000000 0000000000000000
MSG: 00000000000d11cc 0200 0000000000000000 000000000013011b
MSG: 00000000000d11cc 0200 0000000000000000 00000000000f0119
MSG: 00000000000d11cc 0200 0000000000000000 0000000000080116
MSG: 0000000000000000 0113 0000000000000a3d 00007ff9cb0a2b10
MSG: 00000000000d11cc 0200 0000000000000000 0000000000060115
MSG: 0000000000230e2e 0200 0000000000000000 00000000001a0112
MSG: 0000000000230e2e 0200 0000000000000000 00000000001a0112
MSG: 00000000000d11cc 000f 0000000000000000 0000000000000000
MSG: 0000000000230e2e 0200 0000000000000000 0000000000180110
MSG: 0000000000230e2e 0200 0000000000000000 000000000015010f
MSG: 0000000000161102 0200 0000000000000000 00000000000a0107
MSG: 0000000000161102 0200 0000000000000000 00000000000a0107
MSG: 0000000000161102 000f 0000000000000000 0000000000000000
MSG: 0000000000161102 0200 0000000000000000 0000000000080107
MSG: 0000000000161102 0200 0000000000000000 0000000000070106
MSG: 0000000000161102 0200 0000000000000000 0000000000030103
MSG: 0000000000161102 0200 0000000000000000 0000000000020103
MSG: 0000000000161102 0200 0000000000000000 0000000000000102
MSG: 0000000000230e2e 0200 0000000000000000 0000000000040106
MSG: 0000000000230e2e 0200 0000000000000000 0000000000040106
MSG: 0000000000161102 000f 0000000000000000 0000000000000000
MSG: 0000000000230e2e 0200 0000000000000000 0000000000030106
MSG: 0000000000230e2e 0200 0000000000000000 0000000000000103
MSG: 00000000001611fa 00a0 0000000000000005 00000000007f0159
MSG: 00000000001611fa 00a0 0000000000000005 00000000007f0159
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 00000000001611fa 00a0 0000000000000005 00000000007e0158
MSG: 00000000001611fa 00a0 0000000000000005 00000000007a0157
MSG: 00000000001611fa 00a0 0000000000000005 0000000000770157
MSG: 00000000001611fa 00a0 0000000000000005 0000000000760156
MSG: 00000000001611fa 00a0 0000000000000005 0000000000720154
MSG: 00000000001611fa 00a0 0000000000000005 00000000006f0153
MSG: 00000000001611fa 00a0 0000000000000005 00000000006e0153
MSG: 00000000001611fa 00a0 0000000000000002 00000000006a0152
MSG: 00000000001611fa 00a0 0000000000000002 0000000000690152
MSG: 00000000001611fa 00a0 0000000000000002 0000000000670150
MSG: 00000000001611fa 00a0 0000000000000002 0000000000650150
MSG: 00000000001611fa 00a0 0000000000000002 000000000063014f
MSG: 00000000001611fa 00a0 0000000000000002 000000000060014f
MSG: 00000000001611fa 00a0 0000000000000002 00000000005f014f
MSG: 00000000001611fa 00a0 0000000000000002 00000000005e014f
MSG: 00000000001611fa 00a0 0000000000000002 00000000005c014e
MSG: 00000000001611fa 00a0 0000000000000002 00000000005a014e
MSG: 00000000001611fa 00a0 0000000000000002 000000000059014e
MSG: 00000000001611fa 00a0 0000000000000002 000000000056014e
MSG: 00000000001611fa 00a0 000000000000000c 000000000054014e
MSG: 00000000001611fa 00a0 000000000000000c 000000000053014e
MSG: 00000000001611fa 00a0 000000000000000c 000000000051014e
MSG: 00000000001611fa 00a0 000000000000000c 000000000050014d
MSG: 00000000001611fa 00a0 000000000000000c 00000000004f014d
MSG: 00000000001611fa 02a2 0000000000000000 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000161102 0118 000000000000ffff fffff960001e2670
WM_ACTIVATE 0000000000000000 0000000000000000, lastfocus 0000000000161102, curre
nt focus 0000000000161102
MSG: 0000000000161102 000f 0000000000000000 0000000000000000
MSG: 0000000000000000 0113 0000000000000a39 00007ff9cb0a2b10
MSG: 0000000000120fbc 0113 0000000000000001 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000000000 0113 0000000000000a34 00007ff9cb0a2b10
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702d9
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702da
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702db
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702dd
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702de
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702df
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702e0
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702e1
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702e2
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702df
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702dd
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702da
MSG: 00000000001611fa 00a0 0000000000000002 00000000006702d9
MSG: 00000000001611fa 02a2 0000000000000000 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02d9
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02da
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02dc
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02df
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02e0
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02e5
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02e6
MSG: 00000000001611fa 00a0 0000000000000005 00000000007b02e9
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02eb
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02ee
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f0
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f2
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f3
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f4
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f5
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f6
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f7
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02f8
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02fb
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02fd
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c02ff
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0301
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0302
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0303
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0304
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0305
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0307
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0306
MSG: 00000000001611fa 00a0 0000000000000005 00000000007c0305
MSG: 00000000001611fa 00a0 0000000000000005 00000000007a02fc
MSG: 00000000001611fa 00a0 0000000000000005 00000000007802f6
MSG: 00000000001611fa 00a0 0000000000000005 00000000007402de
MSG: 00000000001611fa 02a2 0000000000000000 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000
MSG: 0000000000130eae 0113 000000000000002d 0000000000000000

Post by **void** » Mon Nov 09, 2015 1:43 am

Thanks for the debug output.

Hmm, I might have VeraCrypt setup incorrectly.

When I mount a VeraCrypt volume I see two volumes.
F:\ and M:\
I choose the M: from the VeraCrypt window when mounting my volume from a file.
I can't remember setting up the F: drive.
When mounting is complete, the F: and M: drive point to the same VeraCrypt volume.

VeraCrypt is not sending any device removal requests for the F:.
Everything only receives removal requests for the M: drive.

Everything 709b is detecting these M: drive requests and passing them to the service correctly for me.
If I include only the M: drive in Everything, the VeraCrypt volume will successfully dismount.
If I leave the F: drive included in Everything, VeraCrypt will be unable to dismount.

Do you see something similar?

From a limited account I start the service with Everything -svc

The service must be installed from Tools -> Options -> General -> Everything Service, the service in Everything 709b can run as a normal app like in previous versions.

froggie · Post by **froggie** » Mon Nov 09, 2015 3:11 am

Hmm, I might have VeraCrypt setup incorrectly.

When I mount a VeraCrypt volume I see two volumes.

You might take a look at https://veracrypt.codeplex.com/workitem ... edByLink18

it might be a VeraCrypt bug that is creating the problem.

Ethan · Post by **Ethan** » Mon Nov 09, 2015 5:31 pm

froggie wrote:
Hmm, I might have VeraCrypt setup incorrectly.

When I mount a VeraCrypt volume I see two volumes.
You might take a look at https://veracrypt.codeplex.com/workitem ... edByLink18

it might be a VeraCrypt bug that is creating the problem.

That bug should be solved in VeraCrypt 1.16 tho, which is the latest version available.

void wrote:The service must be installed from Tools -> Options -> General -> Everything Service, the service in Everything 709b can run as a normal app like in previous versions.

Mmh, then there's something buggy with the service too, possibly unrelated to the handling of VeraCrypt volumes.
I mean, till 707b I always used Everything in a 100% portable way under a limited account with this command line at startup:

Code: Select all

Everything -svc
Everything -startup

I get the UAC prompt, enter the admin password, click OK, and then everything works smoothly perfectly.
With 709b things are broken, and apparently Everything client can't connect to the service anymore. I tried Tools -> Options -> General -> Everything Service too, all I got was an UAC prompt, and then an error message code 5 (Everything service can't be installed). So I assume is not an issue of service-client communication, but rather the very service that can't work.

Post by **void** » Tue Nov 10, 2015 6:31 am

You might take a look at https://veracrypt.codeplex.com/workitem ... edByLink18

Thanks for the link, seems to have fixed the double volume issue.

Running the Everything 1.4 service as a normal application does not monitor file systems.
There is a bug in 709b that prevents the client from ever connecting to a 709b service running as a normal app, this has been fixed for the next beta update.

There's also issues with monitoring VeraCrypt volumes with the service which I am currently working on.
Hope to have a beta update soon.

Ethan · Post by **Ethan** » Sun Dec 08, 2019 3:11 pm

Hi void,
I'm using Everything 1.4.1.959 (x64) portably on Windows 8.1 x64, with VeraCrypt 1.24-Hotfix1 x64.
I'm using a standard (limited) account, with Everything service launched from an elevated prompt with

Code: Select all

Everything -svc

and Everything client launched from an unelevated prompt with

Code: Select all

Everything -startup

.
Veracrypt is installed on my system (therefore I'm not using portably).
Seems like the Everything client can't close all the handles to a mounted VeraCrypt volume.
I attached the debug log, notice how (as far as I can see) Everything receives correctly the unmount notification

Code: Select all

WM_DEVICECHANGE 0000000000008003 000000000013fba0

but apparently it can't release it

Code: Select all

RegisterDeviceNotification Z: failed! 1066

(Z: is the encrypted mounted volume)

Post by **void** » Mon Dec 09, 2019 1:43 am

RegisterDeviceNotification Z: failed! 1066

This is normal when running the Everything Service as a normal program.

Also, the client should be monitoring the VeraCrypt volumes, not the Everything Service.
The Everything Service will only monitor system volumes (C: drive).

RegisterDeviceNotification Z: failed! 1066

It looks like the log is from the client (not the Everything Service)
Are you running the client as a service?
Error 1066 is: The service has returned a service-specific error code.

stop ntfs_monitor Z: 4294967295 00000000003df650

It looks like the monitor for this volume is stopped. However, it is immediately restarted.. I'll look into the issue.

Did this issue start occurring with Everything 1.4.1.959?

Ethan · Post by **Ethan** » Mon Dec 09, 2019 7:28 am

No, I'm running the client as a normal, unelevated program (in order to be fully portable).
The problem started long ago... actually, by memory, it always happened.
Is there anything else I could provide? (logs, config, Process Hacker screens...)

Post by **void** » Wed Dec 11, 2019 12:47 am

Is there anything else I could provide? (logs, config, Process Hacker screens...)

Not at this stage, thanks.
Looking into this some more...

The error code 1066 from RegisterDeviceNotification is a generic error code. I'm not sure what the exact problem is..

Because RegisterDeviceNotification fails, Everything will always immediately re-monitor your Z: after it receives a successful pending removal request.

It could be a structure alignment.. Could you please try the x86 version of Everything.

Ethan · Post by **Ethan** » Wed Dec 11, 2019 10:16 pm

Same behaviour.

Post by **void** » Thu Dec 12, 2019 7:33 am

Could you please try Everything 1.4.1.960.

This version should not hang onto a volume handle after RegisterDeviceNotification fails.

Ethan · Post by **Ethan** » Thu Dec 12, 2019 10:38 pm

Oh yeah, now dismounting volumes works without a problem, thank you!

icabod · Post by **icabod** » Thu Nov 05, 2020 8:57 pm

I had this problem too, then I came across this solution and upgraded Everything. It was working for a while, but now I am having problems again being unable to unmount Veracrypt volumes because everything.exe has open handles.

I'm running:
Everything 1.4.1.992
VeraCrypt: 1.24-Update6

Also, I don't know if it matters, but I'm indexing the volumes in Everything as "Folders" on the volume root (e.g., "H:\") and not as NTFS.

Post by **void** » Thu Nov 05, 2020 9:44 pm

Everything should be registering for device notifications for your H: drive.

If you run "Everything" as an admin, Veracrypt might be unable to send "Everything" volume removal requests.

Please try running Everything as a standard user:

In "Everything", from the Tools menu, click Options.
Click the General tab on the left.
Check Everything service (only required if you are indexing NTFS volumes).
Uncheck Run as administrator.
Click OK.
Exit Everything (right click the Everything tray icon and click Exit).
Restart Everything.

Please check your debug logs for any error codes:

Completely exit Everything (right click the Everything tray icon and click Exit).
Launch Everything with the -debug-log command line option:
Everything.exe -debug-log
Once Everything has started and is showing results, please try dismounting your H: drive.
What is shown in your %TEMP%\Everything Debug Log.txt? -look for the following lines:
RegisterDeviceNotification H: OK
RegisterDeviceNotification H: failed! <error-code>
WM_DEVICECHANGE <event>
stop folder monitor H:
restart folder read directory changes monitor H:
Restart Everything to exit debug-logging mode:
In "Everything", type in the following search and press ENTER:
/restart

It might be a icon shell extension holding onto a handle?

To disable icon shell extensions:

In "Everything", type in the following search and press ENTER:
/icon_shell_extensions=0
Type in the following search and press ENTER:
/restart

Please try dismounting your H: drive, does the issue persist?

To re-enable icon shell extensions:

In "Everything", type in the following search and press ENTER:
/icon_shell_extensions=1
Type in the following search and press ENTER:
/restart

This is not a solution... However, this would indicate the issue is with the monitoring of your H: drive:
Please try disabling monitoring on your H: drive.

In Everything, from the Tools menu, click Options.
Click the Folders tab on the left.
Select your H: drive
Uncheck Attempt to monitor changes.
Click OK.

Please try dismounting your H: drive, does the issue persist?

Re-enable H: drive monitoring:

In Everything, from the Tools menu, click Options.
Click the Folders tab on the left.
Select your H: drive
Check Attempt to monitor changes.
Click OK.

Everything could be performing a background rescan. You will be unable to dismount your H: drive until this background rescan completes.
Rescan progress is shown in Tools -> Options -> Folders (your H: drive would be listed as H: [rescanning] ).

icabod · Post by **icabod** » Thu Nov 05, 2020 11:26 pm

Thank you! OK, I'm walking through your steps:

> If you run "Everything" as an admin, Veracrypt might be unable to send "Everything" volume removal requests.
> Please try running Everything as a standard user:
It is already configured this way.

> Please check your debug logs for any error codes:
> Completely exit Everything (right click the Everything tray icon and click Exit).
I did not have the tray icon enabled actually. I just UNchecked the "Run in background" option and exited, and the H: handle disappeared. (I'm searching in Windows Process Explorer.)

Maybe this is all I need to do?

>Launch Everything with the -debug-log command line option:
> Everything.exe -debug-log
Did you want me to run the service this way? Sorry, it's unclear on that linked page which scenario you are asking me to do.

When I restart Everything.exe (normally) the H: handle reappears. Dismount is not possible.

> Rescan progress is shown in Tools -> Options -> Folders (your H: drive would be listed as H: [rescanning] ).
It's not rescanning.

ADDITIONAL DETAILS IN CASE THEY ARE RELEVANT:
Options --> General:
Run as Administrator is UNchecked.
Everything service is Checked.
--> UI:
Run in background is UNchecked. (I just changed this during steps above.)
Show tray icon is UNchecked.
Indexes --> NTFS:
Automatically include new fixed volumes is UNchecked.
Automaticlaly include new removable volumes is UNchecked.
Automatically remove offline volumes is UNchecked.
"Local Disk (H:)" appears and is UNchecked for Include in database.
--> Folders:
"H:\" appears and is Checked for Attempt to monitor changes.

Post by **void** » Fri Nov 06, 2020 12:13 am

Thanks for your reply.

Process Explorer will show Everything having an open handle to your H: drive.
This is normal when Tools -> Options -> Folders -> H: -> Attempt to monitor changes is enabled.

The problem sounds like Everything is not receiving any notification to close this handle when the volume is to be dismounted.
The debug logs will show this.

Did you want me to run the service this way? Sorry, it's unclear on that linked page which scenario you are asking me to do.

No, just the search client.
Ignore the Debug Logging Help page for now.
Exit the Everything search client (close the search window in your case).
Launch Everything.exe with the -debug-log command line option:
Everything.exe -debug-log
Let Everything startup and show some results.
Attempt to dismount your H: drive.
What is shown in your %TEMP%\Everything Debug Log.txt?

icabod · Post by **icabod** » Fri Nov 06, 2020 12:43 am

Got it. OK, so yes the log shows:
2020-11-06 01:39:18.725: RegisterDeviceNotification H:\ failed! 1066

No instances of:
WM_DEVICECHANGE <event>
stop folder monitor H:
restart folder read directory changes monitor H:

Post by **void** » Fri Nov 06, 2020 2:22 am

Thanks for the logs.

2020-11-06 01:39:18.725: RegisterDeviceNotification H:\ failed! 1066

I'm getting the same error.
Looks like VeraCrypt does not support RegisterDeviceNotification.

However, in my tests (VeraCrypt: 1.24-Update7), from my debug logs, Everything receives:
WM_DEVICECHANGE 0000000000008003

This is the 'device remove pending' notification. When Everything receives this, it will stop the veracrypt monitor:
From my debug logs:
stop folder read directory changes monitor 00000000011fbf50
stop folder monitor Y:\ 00000000011f7b10

The volume is successfully dismounted.

For some reason you are not receiving this notification.
Could you please check Veracrypt and Everything are running as the same user -Check with the Task Manager, under Details, make sure the User Name is the same for both Everything and Veracrypt processes. (There will be one Everything.exe running as SYSTEM, this is the Everything Service, Ignore this one)
-Note: different users still worked for me (Everything as admin or Veracrypt as admin). However, you might be seeing a session isolation issue or a User Interface Privilege Isolation issue.

Was veracrypt started while logged in as another user?
Please try VeraCrypt: 1.24-Update7.
Please try stopping any other applications which might be processing WM_DEVICECHANGE and preventing Everything from receiving this notification.

icabod · Post by **icabod** » Fri Nov 06, 2020 3:06 am

Thanks again. Here is the info:

> Could you please check Veracrypt and Everything are running as the same user
One Everything.exe running as SYSTEM
One Everything.exe running as myname
One VeraCrypt.exe running as SYSTEM
One VeraCrypt.exe running as myname

> Was veracrypt started while logged in as another user?
No, I'm using Veracrypt on startup for an encrypted system volume.

> Please try VeraCrypt: 1.24-Update7.
I actually did that in the interim.

It required a restart. And after the restart a mount/unmount test on H: worked. (Note, I have not seen the problem often though that I can recall, so I would not likely say the upgrade fixed things. Perhaps the reboot did?)
EDIT: It just happened with another volume I use called R:
2020-11-06 04:14:03.336: RegisterDeviceNotification R:\ failed! 1066

> Please try stopping any other applications which might be processing WM_DEVICECHANGE and preventing Everything from receiving this notification.
I'm not sure what that would mean actually.

icabod · Post by **icabod** » Sat Nov 07, 2020 5:51 pm

So, is that error helpful for troubleshooting?

RegisterDeviceNotification R:\ failed! 1066

Post by **void** » Sat Nov 07, 2020 11:14 pm

Error 1066 is: The service has returned a service-specific error code.

It most likely means the Veracrypt drive does not support RegisterDeviceNotification.
(I also get this error on my Veracrypt test vm)

Everything uses two methods to receive pending device removal notifications:
RegisterDeviceNotification with a handle.
WM_DEVICECHANGE with DBT_DEVICEREMOVEPENDING and with DBT_DEVTYP_VOLUME.

In your case, it looks like Everything is only sometimes receiving the second.

Note: Everything will ignore pending device removal notifications if the database is still loading or being created.

There is little I can do if Everything never receives the pending device removal notification.

Consider disabling monitor changes for your Veracrypt drives:

In Everything, from the tools menu, click Options.
Click the Folders tab on the left.
Select your Veracrypt drive.
Uncheck Attempt to monitor changes.
Consider scheduling a rescan more often (eg: every hour)
Click OK.

Everything might be taking too long to respond to a previous WM_DEVICECHANGE notificiation.
I'll look into this some more..

icabod · Post by **icabod** » Sun Nov 08, 2020 1:20 am

Thanks! It's good to know that unchecking Attempt to monitor changes could be a workaround. I'll try that. Because these are small volumes (~1GB), I imagine that frequent rescans (30 minutes) wouldn't have a very big hit?

I mount and unmount them frequently, so reliable unmounting would be more important than realtime reindexing. Will it rescan upon mounting if the configured time has passed since it was last unmounted?

Post by **void** » Sun Nov 08, 2020 2:40 am

I imagine that frequent rescans (30 minutes) wouldn't have a very big hit?

Depends on how many files you are indexing. 1 million files will take about 10 minutes to rescan.

Will it rescan upon mounting if the configured time has passed since it was last unmounted?

Currently, no.
If the scheduled rescan is missed due to the folder being offline, the rescan is rescheduled.

Rescanning a folder index that missed a scheduled rescan as soon as it becomes online is in development.

icabod · Post by **icabod** » Mon Nov 23, 2020 2:29 pm

Just a ping on this thread again to ask for guidance on the best way to handle TrueCrypt/VeraCrypt volumes...

Would it be better to index my large removable VeraCrypt NTFS volumes as "NTFS" in Everything, or keep them as "Folders"?

Thank you.

Post by **NotNull** » Mon Nov 23, 2020 3:37 pm

Not a VeraCrypt user, but after reading this thread, my advice would be to report the issue on the VeraCrypt forums.

VeraCrypt is not sending the correct signal when 'unmounting' a volume.
All these suggestions are workarounds for that. If/when this gets fixed by the VeraCrypt people, you should be able to use NTFS indexing.

icabod · Post by **icabod** » Mon Nov 23, 2020 6:29 pm

Sidebar...

NotNull wrote: ↑Mon Nov 23, 2020 3:37 pm Not a VeraCrypt user, but after reading this thread, my advice would be to report the issue on the VeraCrypt forums.
VeraCrypt is not sending the correct signal when 'unmounting' a volume.

I certainly would report the issue there if it's the source. I just didn't get that instruction or indication from 'void' above. If he can confirm/clarify the problem, I would report there.

NotNull wrote: ↑Mon Nov 23, 2020 3:37 pm All these suggestions are workarounds for that. If/when this gets fixed by the VeraCrypt people, you should be able to use NTFS indexing.

Note: I am using Folder indexing currently and reported this issue using that indexing method. But (if I recall correctly) both the NTFS and Folder indexing methods are subject to the unmount failures.

Post by **NotNull** » Mon Nov 23, 2020 7:48 pm

icabod wrote: ↑Mon Nov 23, 2020 6:29 pm I certainly would report the issue there if it's the source. I just didn't get that instruction or indication from 'void' above.

How did you interpret the following? :

void wrote: ↑Sat Nov 07, 2020 11:14 pm Error 1066 is: The service has returned a service-specific error code.

It most likely means the Veracrypt drive does not support RegisterDeviceNotification.
(I also get this error on my Veracrypt test vm)
[...]
There is little I can do if Everything never receives the pending device removal notification.

icabod wrote: ↑Mon Nov 23, 2020 6:29 pmSidebar...

What do you mean by that?

icabod · Post by **icabod** » Mon Jan 11, 2021 2:08 pm

void wrote: ↑Sat Nov 07, 2020 11:14 pm Error 1066 is: The service has returned a service-specific error code.

It most likely means the Veracrypt drive does not support RegisterDeviceNotification.
(I also get this error on my Veracrypt test vm)

Everything uses two methods to receive pending device removal notifications:
RegisterDeviceNotification with a handle.
WM_DEVICECHANGE with DBT_DEVICEREMOVEPENDING and with DBT_DEVTYP_VOLUME.

In your case, it looks like Everything is only sometimes receiving the second.

Note: Everything will ignore pending device removal notifications if the database is still loading or being created.

There is little I can do if Everything never receives the pending device removal notification.

I have recently installed VeraCrypt and Everything on a new Windows 10 machine and still have the same dismount failures.
@Void, is there an issue I could help report to the VeraCrypt maintainers? What exactly would I say to describe the problem to them?

Thanks!