Potentially disastrous bug?

P

pollution

New Member
I recently found my system partition totally inaccessible to Windows because it was no longer recognized as NTFS. After first suspecting hardware failure of some kind and then digging around a little it appears there are two factors that lead to this major loss of data (without backups that is).

One being the use of Eraser of course and the second, using Eraser to wipe a file downloaded by Orbit Downloader. Below the steps that are reproducible on my system to have the partition trashed they are performed on.

Warning! Do NOT even think about performing the actions described below unless you are prepared to suffer the consequences of data loss. Seriously don't.

-Download any average sized file with Orbit Downloader
-Try to erase the file using the "Only first and last 2KB" pattern [Cluster Tips / Alternate Data Streams both checked though not sure if relevant]

If Eraser returns a error message to you that the deletion has failed, congratulations you just converted your NTFS partition to RAW. All the other wipe methods are not causing any trouble. Now the big question: Is Orbit the culprit here.. Eraser or something else?


Some background info on the system:
Windows XP SP3
Eraser 5.8.7-beta5
Orbit Downloader 2.8.11

There should not be anything more relevant to list afaik.
 
I don't think it has anything to do with Eraser, Windows XP was totally inaccessible to me also but I did have a backup on a USB external drive. What caused this was Orbit Downloader, the night before I had to stop a driveby download which Orbit downloader didn't want to stop downloading and I didn't start the download to start with! Orbit just announced and started the download all by itself.I decided before Orbit downloader could do anything else I was going to uninstall Orbit downloader,which I did that very same night.
 
Well Orbit is most definitely not able to do that on its own, only after using Eraser. You say the same happened to you without touching the files with Eraser?

About starting the download by itself, this is a simple feature which can be turned off. :wink:
 
It's interesting because you mentioned that only the FL2kb will cause the drive to be lost... which does make me believe it is a lock contention issue. But then again, if it was a lock contention issue Eraser will have refused to load the file because we only read/write files using Windows APIs (no more CPU interrupts of the old days) and the Windows APIs are lock-aware... So I can't really pinpoint the cause.

If you're willing to risk a thumbdrive, perhaps you can dump the file there and redo the above sequence and give me the exact error message (the bits found in brackets)

Joel
 
Don't have a spare thumb drive at the moment so I trashed a partition for you again. :lol:

Is this the information you wanted?

Information:
Statistics:
Erased area = 2048 bytes
Cluster tips = 0 bytes

Data written = 2048 bytes
Write time = 0.09 s
Write speed = 22 kB/s

Failures:
Failed: X:\Download\OrbitDownloaderSetup.exe
Click to expand...
 
you know, it's not that I've forgotten about this bug (it's gunna stay open in my firefox for another few weeks until I can solve it - if ever) but it's just really evading me...
 
I've found the problem, but I can't solve it... yet.

Orbit downloads files in chunks and therefore sets all files it downloads as Sparse files. Sparse files are unlike normal files in that when a large portion of the file is undefined that space can be saved. This works great in theory for downloads since they take time and there's no point filling disk space that isn't needed. But in comes Eraser and the key was that you tried erasing using the First/last 2kb process. Because of the way Eraser deals with encrypted, sparse or compressed files (which is to erase the file at the sector level) the first/last 2kb erases the first/last 2kb of the PARTITION the file is on and not the first/last 2kbof the file. This corrupts your drive.

So - the conclusion is that you shouldn't erase files downloaded by Orbit if you want to use the first/last 2KB method. Until I can find an appropriate fix (probably to disable FL2KB when erasing sparse/compressed/encrypted files) please do not attempt to erase Orbit-downloaded files.

Just a note, you are safe from this if:
  • You are using v6 - v6 will refuse to erase such files (so my foresight has paid off!)
  • You are running Vista with UAC turned on and with Eraser NOT running as an Administrator

Joel
 
I've filed a bug updates will be posted there.

Joel
 
Thanks for confirmation and the updates on this matter. Having V5 refuse to wipe sparse files like V6 with this pattern should be a good enough fix for now.
 
Fixed in r1149.

Joel
 
You must log in or register to reply here.
Back
Top