Power failure or hard reset on exFat container gives dismount-fail warning and switches to readonly mode

[andry81]

I have 4 drives with 1 encrypted container in each:
2 drives has exFat container and another 2 drives has NTFS.
2 drives with the exFat are new.

I have had:

• power failure (blue screen), ~2 months ago
• system halt and followed hard reset, today

The power failure happened first when 1 drive with exFat container and 2 drives with NTFS containers were online.

When it happened the VeraCrypt could not mount the exFat container. It reported the Warning:

Warning: The filesystem on the volume mounted as '<drive-letter>' was not
cleanly dismounted and thus may contain errors. Using a corrupted
filesystem can cause data loss or data corruption.

Note: ...

Do you want Windows to attempt to detect and fix errors (if any) on the filesystem?

If press Yes then, opens another dialog:

Warning: Repairing a damaged filesystem using the Microsoft 'chkdsk'
tool might cause loss of files in damaged areas. Therefore, it is
recommended that you first back up the files stored on the VeraCrypt
volume to another, healthy, VeraCrypt volume.

Do you want to repair the filesystem now?

If press Yes then, it starts chkdsk.

The chkdsk prints many fix lines, but seems it is quite strange what it fixes because most of been fixed files were written a long time ago and hasn't been even read on the moment of the failure (I known it 100% for sure).

At the end the chkdsk prints the mysterious error:

An unspecified error occurred <long-hex-number> <short-hex-number>

I don't remember the numbers. But I remember that another 2 NTFS containers has been mounted without an issue.

The exFat container after the mount could not been written. I have checked the mount properties and Read-Only property been set to No.

Today it has happened again, but with another drive with exFat container. And again it reported the warning and switched into the read only mode. And the chkdsk has returned the same error:

An unspecified error occurred (766f6c756d652e63 3f1).

If try to run the check directly:

chkdsk /r /f

Then it reports the same error.

Both drives are new, so I don't think the issue with the drives. Seems the exFat container is unstable for power failure or hard reset.

The files in the corrupted exFat container does not look damaged (and it was the same in the previous time), but I didn't check them closely.

I suggest to use the NTFS as by default with the warning that the exFat usage might be unstable and could give container files corruption.

UPDATE:

I've found another difference, the exFAT does consume more space than NTFS, which is explained here:

https://superuser.com/questions/365739/please-explain-wasted-space-on-an-exfat-formatted-external-hard-drive

The default allocation unit (cluster) size in exFAT is much larger than the default allocation unit size in NTFS. As you've noted in your question, exFAT defaults to 256KB, but NTFS defaults to 4KB for volumes larger than 2 GB.

I've created 2 equal size containers and the exFAT have has larger files occupation size than NTFS.

UPDATE 2:

I've ran chkdsk /r /f for 2 NTFS containers and it doesn't found any errors. I think it has a good probability that the extFAT is broken somehow with conjunction to VeryCrypt at least in Windows 7.

Expected behavior

Writable container after chkdsk.

Observed behavior

The exFat container switched into read only mode.

Steps to reproduce

By accident.

Your Environment

VeraCrypt version: 1.24-Update7 (64-bit)

Operating system and version: Windows 7 x64 Pro SP1

System type: 64-bit

[andry81]

I got a readonly mode after a hang on copy operation into an NTFS volume and force dismounting it after. To fix the volume readonly mode:

1. run diskpart as administrator
2. type list volume
3. choose volume number of the container
4. type select volume <number>
5. type attribute volume clear readonly
6. remount if necessary

I don't know why this happens and don't know why diskpart reports the volume is not in readonly state. But if force to clear it then, it does fix the readonly mode. Seems this can happen after a volume force dismounting.