Blue Screen Troubleshooting Help

To me, this looks like your USB enclosure (not the drive) is going bad.  That is absolutely the most common source of "paging errors" on USB drives (which is what this appears to be).

In your shoes, I would put the drive in a new enclosure, and run chkdsk /f on it (to check for, and hopefully fix,  errors that may have been introduced to the drive while the enclosure was going bad.)

I would feel even more strongly about this diagnosis if you tended to get these errors while doing a lot of disk i/o (e.g, while backing up to the drive), suggesting that the enclosure is overheating.

had you try to test running windows without the USB?

The drive is an enclosed (maybe "sealed" is a better word) unit, one of the Seagate FreeAgent series and has been attached for years, but very easy to disconnect.

The drive was not in use at all when the system crashed.  (No backup running, no paging file on this drive, etc.).

My real question about drives is about this line:  \Device\Harddisk3\D.  Disc Management tells me that "Disc 3" is the Seagate USB.  D: is DVDRW (which was empty at the time).  Which one does the Warning referring to?

Do you ever get these errors when the drive is disconnected?  

In \Device\Harddisk3\D, the "D" at the end is COMPLETELY irrelevant.  It has nothing to do with "Partition D"., or "Drive D".   The string is truncated.  If you were able to see it in full, it would say something like \Device\Harddisk3\DR5.  That is, the DOS name for the drive.  You could run this little piece of software (a USB drive enumerator) to confirm this:

http://www.uwe-sieber.de/files/listusbdrives.zip

running !analyze -v:




0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 896a3da0, Terminating object
Arg3: 896a3f14, Process image file name
Arg4: 805d297c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 896a3da0

IMAGE_NAME:  hardware_disk

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAULTING_MODULE: 00000000

PROCESS_NAME:  csrss.exe

EXCEPTION_RECORD:  a575b9d8 -- (.exr 0xffffffffa575b9d8)
ExceptionAddress: 7c963399
   ExceptionCode: c0000006 (In-page I/O error)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 00000008
   Parameter[1]: 7c963399
   Parameter[2]: c000009a
Inpage operation failed at 7c963399, due to I/O error c000009a

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  7c963399

EXCEPTION_PARAMETER3:  c000009a

IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API.

EXCEPTION_STR:  0xc0000006_c000009a

FAULTING_IP:
+1e7952f013adfdc
7c963399 ??              ???

BUGCHECK_STR:  0xF4_IOERR_C000009A

STACK_TEXT:  
a575b4a4 805d1ac5 000000f4 00000003 896a3da0 nt!KeBugCheckEx+0x1b
a575b4c8 805d2a27 805d297c 896a3da0 896a3f14 nt!PspCatchCriticalBreak+0x75
a575b4f8 ba0feb32 896a3fe8 c0000006 00000000 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
a575b530 a68c80e5 ffffffff c0000006 a5d33074 TfSysMon+0x6b32
a575b574 8054162c ffffffff c0000006 a575b9b0 cmdguard+0x40e5
a575b574 80501161 ffffffff c0000006 a575b9b0 nt!KiFastCallEntry+0xfc
a575b5f4 804fe816 ffffffff c0000006 a575b9f8 nt!ZwTerminateProcess+0x11
a575b9b0 805028cf a575b9d8 00000000 a575bd64 nt!KiDispatchException+0x3a0
a575bd34 80544ef7 010ef81c 010ef83c 00000000 nt!KiRaiseException+0x175
a575bd50 8054162c 010ef81c 010ef83c 00000000 nt!NtRaiseException+0x33
a575bd50 7c963399 010ef81c 010ef83c 00000000 nt!KiFastCallEntry+0xfc
010efe54 00000000 00000000 00000000 00000000 0x7c963399


STACK_COMMAND:  kb

FOLLOWUP_IP:
+1e7952f013adfdc
7c963399 ??              ???

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware_disk

FAILURE_BUCKET_ID:  0xF4_IOERR_C000009A_IMAGE_hardware_disk

BUCKET_ID:  0xF4_IOERR_C000009A_IMAGE_hardware_disk

Followup: MachineOwner
---------

Very nice utility, Akahan.


Friendly Name     = Dell

MountPoint        = J:\
Volume Label      = BU__USB_FreeAgent Drive
Volume Size       = 750 GB (NTFS)
Volume Serial     = 6094-0939
Disk Size         = 750 GB
Volume Name       = \\?\Volume{a3a1bbc4-08b8-11dc-b5da-00123f6f1c10}\
Partition Name    = \Device\Harddisk3\Partition1
Bus Type          = USB
Drive Type        = fixed
Device Types      = ---
Volume DevID      = STORAGE\VOLUME\1&30A96598&0&SIGNATUREA4B57300OFFSET7E00LENGTHAEA8A58400
Drive DevID       = USBSTOR\DISK&VEN_SEAGATE&PROD_FREEAGENT_PRO&REV_400A\____________3QD0WSKM&0
Ctrl  DevID       = USB\VID_0BC2&PID_3010\____________3QD0WSKM
Host Controller   = Intel(R) 82801G (ICH7 Family) USB2 Enhanced Host Controller - 27CC
Volume DosDevName = \Device\HarddiskVolume5
Disk DosDevName   = \Device\Harddisk3\DR7
Removal Policy    = surprise removal ('Optimize for quick removal')
Partition Number  = 1 of 1
Friendly Name     = Seagate FreeAgent Pro
Requested Power   = 0 mA (self powered)
USB Version       = 2.0 (high speed)
USB Friendl. Name = USB device
USB Serial        = ---
USB Port Name     = 5-5


Press any key to close

 

Looks like it was "Disk DosDevName   = \Device\Harddisk3\DR7".  Even though it seems to have more than one DOS name, I'm assuming they all refer to the same USB drive (There are two attached, both are Seagates)

You nailed it.  I ran the Seagate tools and it failed.  This is the drive with all the music on it, so great loss, but a good enough excuse to make a trip to the local shop  ;)