DriveForge v4.4.0

v4.4.0 — 2026-09-30

Added

• Write one image to several drives, one after another. Tick Write this image to several drives under
  the target list and pick the rest from the drives on screen. Each one is erased, written, checked and put
  back before the next begins, so at no point is more than one disk offline. The confirmation lists every
  drive by name, size and what is currently on it — not "8 drives selected" — with the erase warning pinned
  above the list where it cannot be scrolled out of sight, and it will not start until you tick a box that
  names the number of drives. Stop ends the whole run; Pause holds it between drives as well as inside one.
• A result for each drive at the end, not one verdict for the batch. The report gives every drive its own
  line — written, checked, read back different, skipped, never reached — because with eight sticks a single
  "done" is a statement about seven drives nobody looked at. The heading is a count, and a drive Windows
  could not bring back online is named, which the old code silently swallowed behind a green dialog.
• Drives that report no serial number are told apart by the port they are plugged into. Sticks out of one
  bulk pack share their model, their size and, very often, an empty serial — so DriveForge now reads the
  device path as well, and refuses a target it genuinely cannot identify rather than guessing. This also
  strengthens the identity check that stands in front of every destructive operation in the app, not just
  this one.

Changed

• The read-back check is now a box you tick before the write, not a question asked after it. The old
  dialog appeared once the write was already over — by which time an unattended run had nobody at the
  keyboard, so the question sat there and the verification never ran. It is on by default; untick it to skip.
  This also removes the last English-only dialog on that task.
• "Eject the drive when finished" is now visible when writing an image. It was being read on that task
  while living in a section the task hides, so the drive ejected, or did not, according to whatever was left
  ticked during some other job.

Fixed

• A disk left offline by a crash during an image write is brought back at the next launch. If the app was
  killed, or the power went, between taking the disk offline and putting it back, Windows simply kept hiding
  the drive with nothing on screen to explain it. The drive is now recorded by device path — not by number,
  which points somewhere else entirely after an interrupted run — and re-onlined on the next start.

Fixed — second pass, from running every task against real hardware

• A security suite that blocks offline registry access no longer wastes the drive first and explains nothing.
  Everything that personalises an image after it is written — the portable-Windows flags, the Windows 11
  requirement bypass, the local-account bypass, bloatware removal — needs Windows to mount a registry hive out
  of the target, and bcdboot needs it to create the boot record. Some security products refuse that
  machine-wide, and reg reports the refusal as "The filename or extension is too long", which is true of
  nothing involved. DriveForge now asks the question before the confirmation that erases the disk, in the
  same dialog, and says what will be missing if you carry on. During the run the optional settings are skipped
  rather than fatal, and the completion message names what did not get applied instead of only saying
  "finished". Measured: the task used to die at 86%, after a four-minute image apply and before a single boot
  file was written, leaving a drive carrying a complete Windows that could not start.
• When Windows will not write the boot record, the message says so in words. bcdboot reported its refusal
  as "exited with code 183" followed by sixty lines of trace with the one useful line buried in the middle.
  The known cause is now named, along with the fact that the drive will not boot; the trace stays in the log.
• The disk pickers no longer put this PC's own internal drive first. The list is sorted to leave a drive
  that is safe to erase at the top, but the test for "external" counted anything on SATA, and any model name
  containing "SSD" — which is how internal drives describe themselves. On the machine this was found on, the
  pre-selected target for Create Windows USB, Clone, Restore, Format and Wipe was the internal 954 GB
  NVMe. Only the bus a drive is attached by counts now.
• A recovery that comes back empty says so. Nine deleted files were recovered with the right names, the
  right sizes and not one byte of content: the drive had already erased the blocks, as an SSD does within
  seconds of a delete. DriveForge reported "Recovered 9 of 9 files" and left the user to find out by opening
  them. Files that come back entirely empty are now counted and named in the result — separately from partial
  ones, because a full-length file of nothing is not a partial recovery.
• The time remaining is no longer quoted from a speed that no longer exists. A 74-minute clone ended by
  announcing "Remaining: 06:47:35" two minutes before it finished: the copy was over and the run was applying
  permissions, which moves no data, so the trailing average had decayed and the arithmetic did the rest. When
  nothing has moved for a whole window there is no current speed, and the estimate now falls back to elapsed
  time against progress — six minutes for that same sample — or says nothing at all.
• A finished download no longer claims to still be downloading. The status line kept reading
  "Downloading … (100%)" for as long as the window stayed open; measured fourteen minutes after the file was
  complete and its size verified.
• Stop and Pause are back on the three screens that hid them. Download an ISO, Multi-boot USB and
  Export to VHDX all run work that checks for Stop the whole way through — a multi-gigabyte download, the
  Ventoy fetch, a whole-PC export — and all three collapsed the buttons, leaving killing the app as the only
  way out. (Clean traces had already hit this and un-hidden the button for itself; the other three were
  missed.)
• Twenty-one pieces of the interface that never translated. The OK and Cancel buttons of the three
  hand-built dialogs — used about thirty times between them, in front of choosing which disk to erase, which
  partition operation to run and which firmware to boot with — were English string literals in all seventeen
  languages. So were fourteen dialog titles, nine of which already had a translated key sitting unused in the
  string table. So were five live status lines, including the whole visible state of the ISO downloader and the
  line a clone shows for its first several minutes.
• Three more things a screen reader could not read. Export to VHDX was the one sidebar button with no
  name at all, and the rows of every action menu in the app — including the one that picks which disk to erase
  — had none either, because their content is a layout of text blocks rather than text.
• Two claims in the README that were not true. The system disk is not hidden from the target list; it is
  listed last, marked RUNNING WINDOWS (no format/erase), and refused by every task that erases. And the task
  is chosen from the sidebar, not from a dropdown that has been collapsed for some time.

Fixed — third pass, from the partition tools and a read of the flows hardware could not reach

• A Stop during the multi-boot engine download was accepted on screen and then thrown away — and the drive
  was erased anyway. The download is not a child process, so Stop took the no-process path, said
  "Stopping…" and set the flag; the setup code then cleared that flag on its way past and handed the whole
  disk to Ventoy. The user's abort was acknowledged and their data erased in the same breath. Honoured now,
  before anything is touched.
• A recovery read that fails part-way keeps what it rescued. A short read kept its partial file — the code
  says why, and it is right — but an exception deleted every byte already written and reported the file as
  unrecoverable. Those are the same situation, a dying drive, and it is the one this tool exists for.
• Verification no longer excuses a target it could not read. The content check reads the source and the
  freshly written file; when either throws it was filed as "unverifiable protected source file", which the
  caller explicitly treats as not an error. So a bad block on the drive just written — the precise failure
  the option exists to catch — came back as a clean clone. Which side failed is now established before the
  verdict.
• The saved clone report no longer grades itself more kindly than the app did. It computed its own verdict
  from eight checks while the app weighed thirteen, omitting a failed BitLocker request, a raw copy that
  dropped files, regions zero-filled from unreadable source sectors, and both kinds of stop. A clone the app
  had just called needs review was written to the Desktop as "Result: pass" — and the report is the part
  that outlives the dialog.
• The same report no longer claims every file was byte-compared. It said so, and then concluded "no silent
  corruption detected". What actually happens is a presence-and-size check on every file plus a byte-compare
  of the boot-critical ones and one in eight of the rest. It now says that, and the verdict claims only what
  those checks can support.
• A stopped search for lost partitions says it was stopped. The scan exits early on a Stop and on its
  128-find cap, and returned the partial list either way — so pressing Stop on a four-terabyte disk produced
  "No partition signatures were found", the most load-bearing negative answer this tool gives, about a disk
  that had been read to three percent.
• A large but nearly-empty .vhdx is no longer refused as too big. The space gate measured the image
  file, and a fixed-size VHDX's file is its full provisioned size. The restore code says exactly this in its
  own comment and defers the check to after the attach, where the real used size is known; the gate that ran
  first made that unreachable.
• A restore no longer reports driver injection and debloat done by an earlier run. Those counters were
  reset only inside the USB-creation flow, but the completion dialog that reads them is shared with all three
  restore paths — so restoring an image after building a USB in the same session announced "Drivers from this
  PC: 12 package(s) added" about a run that injected nothing.
• Closing the window mid-run no longer leaves the machine holding the pieces. A backup, a clone and a VHDX
  export each take a VSS snapshot and map it to a drive letter, and the backup stages into a .wim.dfnew.
  Closing the window is allowed and kills the work — but it also skips the cleanup, so the snapshot stayed
  registered, the letter stayed mapped (Explorer showing a phantom second copy of Windows), and a partial file
  of up to half the used space sat on the backup drive that nothing would ever resume or remove. All three are
  now undone on the way out.
• Two partition tools spoke for a different tool. Delete a partition on a disk with no volumes answered
  "This disk has no formatted volumes to check" — the file-system checker's sentence, shared with Resize
  and Set active. And Grow with no free space after the partition ran DiskPart and surfaced "The system
  cannot find the file specified", then offered to file a bug report; it now says there is no unallocated
  space immediately after that partition, and why that is the only space it could use.
• The confirmation lists the two options it was leaving out. Remove bloatware and Add this PC's drivers
  both ran and both change the image — one removes apps, the other injects driver packages — and neither
  appeared in the summary shown immediately before the disk is erased.
• Three more pieces of English in the interface: the drive summary and the drive-tools title said
  "Disk N" in every language, and the health report left the previous operation's progress row on screen —
  measured reading "Progress: 100.0% (5.7 / 5.7 GiB)" underneath a health check that had copied nothing.

Fixed — fourth pass, from restoring a real 88.6 GB backup of this PC

• A restore that cannot write the boot record now says so in words. Five flows make a drive bootable and
  all five end at bcdboot, whose failure is an exit code followed by sixty lines of BFSVC trace. Exactly one
  of them — Windows To Go — translated that into a sentence; the other four, including both restore paths,
  showed bcdboot.exe exited with code 1 and the trace. Restore is the flow someone runs standing in front of
  a PC that no longer starts, and the failure is not hypothetical: where security software refuses to mount a
  new boot store, bcdboot fails this way every time, against a freshly formatted partition. All five now give
  the same sentence — the drive will not boot, everything else was copied — and name the antivirus when that is
  what happened. A rule in the test suite fails the build if a new flow ever calls bcdboot directly again.

• A finished operation no longer follows you around the app. The progress row describes the operation that
  wrote it, not the page you are looking at — but leaving a page carried the last run's finished bar along.
  Measured: after securely shredding seven files, Create Windows USB opened with a full bar reading
  "Progress: 100.0% (1.0 / 1.0 GiB)", about work that page had never done, beside an elapsed time of
  00:00:00. Eighteen flows cleared the row themselves and the shredder did not, so it is now cleared at the one
  point every navigation passes through — which retires the whole class rather than one flow's share of it. An
  operation that is still running keeps its row: navigating away mid-run is allowed, and its progress follows.

• The shredder stops claiming it overwrote a gigabyte. Its progress total was floored at 1 GiB — a sensible
  default for whole-disk work, wrong for a handful of files — and completion pins the counter to the total, so
  erasing 2.9 MB ended on "100.0% (1.0 / 1.0 GiB)". From a tool whose entire job is overwriting, that is the
  one number it must not invent. It now uses the real size, and because the size is only shown above 0.5 GB, a
  small shred simply omits it; the bar is pinned directly at the end so it still reads 100% when it finishes.

• The progress row follows the language. Seen on screen in Arabic: the whole window had mirrored and every
  label had changed script, while the row underneath still read "Progress: … | Elapsed: … | Remaining: …" in
  English. The translation existed in all seventeen languages — the row is written from code, and the routine
  that repaints code-written text after a language change did not know about it.

• A restore no longer ends by announcing "USB creation finished." An 88.6 GB backup of this PC was
  restored onto a drive, and the completion dialog said a USB stick had been made. The dialog is shared by
  every job the Start button dispatches and already varies by mode elsewhere; the headline simply never did.
  Someone who has just restored a dead machine's backup should not be told they made a USB stick.

• The progress bar stops walking backwards at the end of a long copy. The copy phase advances through the
  40–82% band while each stage change sets the bar to a fixed value — and the stage that follows the copy was
  pinned at 80%, below the band it was leaving. Measured on a 49-minute restore: 82% → 80%. Every other flow's
  post-copy stages already sat at 84, 86, 88, 90 and 95; the clone and the restore were the two exceptions.

• A restore's remaining time is computed from the image, not from a multiplier. The total was the
  compressed file's size × 1.8 — 159.5 GiB for an image that wrote 141.2 GB — so the bar could never reach
  the top of its band and the countdown swung between "8:05:00" and "1:37" during one copy. The image's own
  uncompressed content size is read six lines earlier for the capacity check; it is now used here too.

Fixed — fifth pass, from an adversarial review of everything the testing changed

Every change made during the testing above was then reviewed by eight independent readers, one per area, and
each finding was put to three more readers whose job was to refute it. Thirty-two claims were raised; ten
survived, and they reduce to these. Three of them were defects introduced by the fixes themselves.

• Polish told users a partition could rosнąć. The word is rosnąć — the third letter was a Cyrillic н
  (U+043D), which renders as a Latin n and is not one. One character, in one string, invisible to the compiler
  and to every key-parity check.
• Six Romanian strings were written in the wrong alphabet. They used the Turkish cedilla ş/ţ where the
  other 629 Romanian strings use the comma-below ș/ț the language actually takes — several mixing both inside
  one sentence — and one misspelled the pluperfect ștersese. Both of these now have a rule: every language
  block is checked against its own alphabet, and the build fails on a letter that does not belong to it.
• Changing the language no longer erases a failed run's verdict. Three flows deliberately leave their result
  in the progress row after the run ends — "Failed after 12:04", or a stopped surface test's partial bar that
  the dialog beside it refers to — and each takes care that nothing later can wipe it. The repaint added for
  Arabic blanked all of it to "0.0% | 00:00:00", turning a failed run into an idle one. A running operation
  still follows the language; an idle row is left alone.
• A clone no longer leaves the window's close handler working against dead state. The clone records its
  shadow copy so that closing mid-run can still undo it, and its cleanup deletes the snapshot but never said so
  — the other two flows that do this were paired correctly, the clone was not. Closing the window any time after
  a clone then spent up to twenty seconds blocking on a snapshot that had been gone for hours.
• The last dialog before a disk is erased no longer promises work that will not happen. Remove bloatware
  and the two driver-injection options are hidden and disabled when the mode changes, but never unticked — so
  ticking them to build a Windows USB and then starting a restore listed them in the final confirmation,
  about a flow that never applies them. The summary now lists an option only when the mode can actually run it.
• A finished export reports the size it wrote. The progress total is an estimate — the used space of C: —
  and the engine skips the pagefile, the hibernation file and the temp tree, so on a real run it read 418.7 GiB
  for an image holding 219.7 GiB. Measuring beats estimating once the copy has stopped, and the measurement was
  there all along.

Fixed — sixth pass, from installing the multi-boot engine for real

• The multi-boot drive picker now says which of the disks it lists is not a removable drive. It asks
  "Choose the USB drive to use as a multi-boot drive" and then offers every disk that is not the running
  Windows — on the machine this was found on, that meant the internal 954 GB NVMe appeared in the list, and on
  an ordinary PC it means the second internal drive with the user's data on it. Two things were already right:
  removable drives sort first, so the default selection is safe, and the confirmation that follows names the
  disk, its size and its contents before anything is erased. What was missing was any way to tell, in the list
  itself, that one of those lines is an internal disk. Each one that is not removable now says so.

Under the hood

• The write, verify, re-online and eject sequence now exists in exactly one place, and the parts that must
  happen once per run rather than once per drive — the busy state, the stopwatch, the progress total, the
  completion chime — are owned by the code that runs the queue. A second copy of that sequence is what the
  previous release spent a day removing from seventeen other flows.
• The two checks that erase a disk on this task are now covered by the invariant suite, which had never
  looked at this flow at all. 21 new strings in all 17 languages; one dead string removed.
• Four new checks, each one written after the defect it catches: every sidebar button must carry a
  screen-reader name, no button built in code may have a caption typed into the source, no status line may
  be written in English from the code, and the machine's own internal drive must never rank as "external".
  27 further strings in all 17 languages.

---

Full changelog