Windows 10 appears to corrupt FAT

Question

I'm working on a firmware which was developed in 2011. The device has a USB OTG module and can be plugged into USB port of a PC. It has a 1 MB flash memory. When USB plug in is detected, the firmware generates two files, a PDF and a TTV (proprietary format). Those files are saved in the flash memory. Then the flash memory is exposed to Windows as mass storage device. The firmware always generates the files and then exposes the device to Windows. User can read the files and also put their own file on the flash device.

The firmware uses FatFs library for the file system. We're using FAT format for the flash storage.

When USB plugged in, if the PDF and TTV files are not found in the file system, then they are generated by the firmware and saved in the file system.

Now consider the following workflow:

1. User formats the flash drive from Windows 10. It has to be a low level format. Windows generates a folder named "System Volume Information."
2. The device is unplugged.
3. The device is plugged in.
4. The firmware detects the absence of the files.
5. Firmware generates the PDF file. Saves it using the file system. FAT and Root directory updated accordingly.
6. Firmware generates the TTV file. Saves it using the file system. FAT and Root directory updated accordingly.
7. Firmware exposes the flash drive to Windows.
8. The PDF file is randomly found corrupted.

What happens when Windows 10 formats a FAT file system? It creates a FAT in either of the following 3 fashions:

Style 1

Style 2

Style 3

Consider Style 1. When firmware will generate the PDF file, it will start from cluster 5 (as FAT[0] to FAT[4] are occupied). All goes well. The PDF file can be opened from the flash drive from Windows.

Consider Style 2. When firmware will generate the PDF file, it will start from cluster 3. The firmware generates PDF and TTV files, saves them in flash memory, updates FAT and root directory correctly (I'm certain as I've seen this from debug). When the device is plugged in, Windows writes 0x000 to FAT[3] and all other FAT entries which spanned the PDF file!

The entry in the root directory is still there for the PDF file.

This results in corrupted PDF when the PDF file is opened from Windows 10 in any PDF reader. Similar thing appears in Style 3 too. It appears that Windows 10 doesn't like other device to write in cluster 0 to cluster 4 (cluster 0 and 1 are already reserved).

This doesn't occur in any prior version of Windows (7 or 8.x).

So what happens to Windows 10? Why Windows 10 is corrupting the FAT?

Answer 1

Thank you for the prompt response.

It is still a possibility that the issue is due to a misconfiguration when the USB storage device was formatted. Since the corruption issue also happens on other Windows 10 PCs, it would be best to post your concern in the TechNet. The IT Pro audience of TechNet can provide a better input on what might be causing the issue.  You can post your issue in the TechNet Windows 10 Security forums.

Let us know if you have other questions.

Answer 2

Hi Devlin,

Thank you for your reply.

Please find below the answers to your questions:

• Yes, the PC we're using at our office are connected to a domain.
• Same issue occurs on different Windows 10 machines when the device is plugged in. However, the corruption doesn't occur when FAT[0] to FAT[4] are non-zero entries (check Style 1 above). When format from Windows 10, it sometimes fills up FAT[0] to FAT[4]; sometimes FAT[0] to FAT[3]; sometimes FAT[0] to FAT[2]. Corruption occurs in later 2 cases. We haven't observed this behaviour on Windows 7 or 8.x.
• No. The firmware first fills up the flash memory with files. Populates FAT and root directory correctly. Then it exposes the drive to Windows and from that point onward the firmware doesn't do anything with the file system. Again, this is the same firmware and FAT corruption doesn't occur in Windows 7 or 8.x.

Please let me know if you need more information.

Answer 3

Hi Donotalo,

It is possible that we need to configure the settings that apply to your USB storage device or it could be an issue with the storage format. That being said, we would like to know the following information so we can either provide further troubleshooting or refer your issue to the correct TechNet or Microsoft Developer Network(MSDN) channel to address this properly:

• Are you connected to a domain?
• Have you tested if the same issue occurs when you plug in the USB storage device to a different PC?
• Are you trying to modify your USB storage device on how should it be read by your Windows PC when adding files on it?