Detecting a USB Unmount?

Go To Last Post
3 posts / 0 new
Author
Message
#1
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Does anyone know anything about the unmounting process of a FAT filesystem? I'm mostly concerned with a USB mounted FAT filesystem (think SD card), and if I would be able to identify any particular "unmount" or "eject" SCSI commands.

For example, if I have a USB CD-ROM, there's the START STOP UNIT Command, which is responsible for physically stopping and ejecting the CD. Is there an equivalent for SD cards?

I have a USB sniffer (TotalPhase Beagle 480, it's pretty awesome), and I did a quick experiment. I have a FAT formatted SD card, and an SD card reader. I plugged that into a Linux computer, via the USB sniffer, and I waited for the computer to automatically mount the SD card. After it mounted, I unmounted it, and saw a single "WRITE(10)" command pass, with the following output:

Hex:

52 52 61 41 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 72 72 41 61
95 CC 0D 00 ED 2A 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 55 AA

ASCII:

RRaA....
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
........
....rrAa
.....*..
........
......U.

I'm not really familiar with WRITE(10) commands, I've only read from SD Cards before, but that doesn't look like a typical WRITE(10) command, not with all of those zeros. Is this "unlocking" the partition for someone else to mount it? If so, then I'd be able to use this as my unmount signal, though I'd prefer not to have to search every WRITE(10) command for a particular pattern as that'd lower transfer speed.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

*sigh*

I forgot there's not only "umount" but also "eject" in Linux. When issuing an "eject" command I get a START/STOP UNIT command to issue (as well as unmounting the device). Oddly enough, Windows has somewhat more logical behavior, when you right click the drive in Windows Explorer and click "Eject" it issues a Prevent/Allow Medium Removal and then a START/STOP UNIT command.

I'll just leave this up in case anyone else ever needs this information.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

That looks like the operating system is updating the FAT32 info sector about the amount of free clusters and the most recently allocated cluster, meaning you have 904341 free clusters on your drive.

Definitely that cannot be used for detecting unmount, because that is FAT32 specific.

For FAT16 formatted card, it might be that you get nothing, the operating system might just stop using the device.

But clearly there are USB hard drives that spin down after unmounted/ejected, so something is sent - the START/STOP you mentioned can do that.

So for just unmount - nothing, hard drive keeps spinning.
For eject - START/STOP sent so hard drive shuts down.