mrcbt Event ID #7 - suprise removal


Author
Message
jfads
jfads
New Member
New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)New Member (2 reputation)
Group: Forum Members
Posts: 1, Visits: 5
I have been getting rather frequent system errors - that always seem to chain together and result in a USB hard drive removing itself... some background...
I have been using Macrium for some time without drama.  For a while (don't know how long) I have been having errors that my backup drives were not available - they were fully plugged in but not recognized by Windows.  My backups are on two SSD drives and they both go down at the same time.  Initially I thought I had a bad USB hub - replaced it.  Bad USB drives - replaced... nothing to date has worked.  I have changed ports on the hub and where I plug in the hub.  I have changed cables, cleaned out shadow copies of USB drives/hubs, looked for new drivers, deleted drives and let windows reinstall the drives.  There are probably a number of things that I have done for better or worse that I can't remember at the present...
I have yelled at the computer in both binary and hex to no avail.  I am not technical but I have found that selectively beating on the machine does sometimes work.

The pattern that I think I am finding is a COM warning ID #10016 - Local Activation Permission; followed by information on a DeviceStop ID#100; followed by mrcbt ID #100 - surprise removal - (IRP_MN_SURPRISE_REMOVAL); followed by the second mrcbt ID #100 - surprise removal - (IRP_MN_SURPRISE_REMOVAL); finally finishing with another COM warning ID #10016 - Local Activation Permission.

I am putting this on the Macrium site because of comments that Macrium was creating the shadow drives when creating the backup.  I have not done a RegEdit on the key to change the permission as the info that I found was from around 2016 and was for different keys.

I am lost as to why and how to hone in on identifying the problem as opposed to the symptoms...

Thanks


JamieW
JamieW
Macrium Representative
Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)Macrium Representative (362 reputation)
Group: Moderators
Posts: 262, Visits: 4.1K
jfads - 16 April 2021 1:23 AM
I have been getting rather frequent system errors - that always seem to chain together and result in a USB hard drive removing itself... some background...
I have been using Macrium for some time without drama.  For a while (don't know how long) I have been having errors that my backup drives were not available - they were fully plugged in but not recognized by Windows.  My backups are on two SSD drives and they both go down at the same time.  Initially I thought I had a bad USB hub - replaced it.  Bad USB drives - replaced... nothing to date has worked.  I have changed ports on the hub and where I plug in the hub.  I have changed cables, cleaned out shadow copies of USB drives/hubs, looked for new drivers, deleted drives and let windows reinstall the drives.  There are probably a number of things that I have done for better or worse that I can't remember at the present...
I have yelled at the computer in both binary and hex to no avail.  I am not technical but I have found that selectively beating on the machine does sometimes work.

The pattern that I think I am finding is a COM warning ID #10016 - Local Activation Permission; followed by information on a DeviceStop ID#100; followed by mrcbt ID #100 - surprise removal - (IRP_MN_SURPRISE_REMOVAL); followed by the second mrcbt ID #100 - surprise removal - (IRP_MN_SURPRISE_REMOVAL); finally finishing with another COM warning ID #10016 - Local Activation Permission.

I am putting this on the Macrium site because of comments that Macrium was creating the shadow drives when creating the backup.  I have not done a RegEdit on the key to change the permission as the info that I found was from around 2016 and was for different keys.

I am lost as to why and how to hone in on identifying the problem as opposed to the symptoms...

Thanks


Hi @jfads,

Thank you for your post.

Under normal circumstances, when using Safe Eject for USB devices, Windows will send an IRP_MN_QUERY_REMOVE_DEVICE notification to all volumes (mounted file-systems) on the device to allow them to flush any internal buffers. If all volumes respond approvingly to this notification, Windows will then send an IRP_MN_REMOVE_DEVICE notification to all volumes on the device to complete the removal.

Only when a USB device is unplugged without using Safe Eject (or experiences a power failure or similar), Windows will send an IRP_MN_SURPRISE_REMOVAL notification to the volumes to notify them to discard the contents of their internal buffers and complete the removal.

CBT is simply reporting this event to indicate that the USB device has been removed from the system in an unsafe manner.

It is unlikely that this is caused by software and is most likely a hardware issue, however; if you would like to open a support ticket at https://helpme.macrium.com (referencing this post), then we can arrange to get a copy of the Windows logs and see if we can provide any further assistance.

Kind regards,

Macrium Development

Next Webinar


GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Reading This Topic

Login

Explore
Messages
Mentions
Search