AutoRun on and after Removal
In analogy to the OnArrival function USBDLM can execute a command-line when a drive is "prepared for safe removal" and after a drive has been removed.
1. On preparation for safe removal
When a USB or Firewire drive becomes "prepared for safe removal" the USBDLM can react while the drive is still available.
This should not take too long, the maximum time is 30 Seconds under XP, and 15 Seconds since Vista/Win7. But while the notification is processed, no other events can be handled. Therefore USBDLM wait up to 10 Seconds only. If the started process is still running after this time, then USBDLM rejects the removal request. Windows then says "USBDLM prevents the removal...".
The OnRemovalRequest section for a drive should be created before the drive in question is attached.
As with OnArrival, the parameter Letter is a criterion here.
Sample to copy the file c:\test.txt to the folder \backup on the drive to remove:
[OnRemovalRequest]
open="%windir%\System32\cmd.exe" /c copy "C:\test.txt" %drive%\backup
Same, but for drive X: only:
[OnRemovalRequest]
Letter=X:
open="%windir%\System32\cmd.exe" /c copy "C:\test.txt" %drive%\backup
As in the first sample but only if the file \backup\test.txt exists on the drive to remove:
[OnRemovalRequest]
FileExists=%drive%\backup\test.txt
open="%windir%\System32\cmd.exe" /c copy "C:\test.txt" %drive%\backup
Unmount a TrueCrypt volume T: when the file secret.tc is found on the drive to remove:
[OnRemovalRequest]
FileExists=%drive%\secret.tc
open="%ProgramFiles%\TrueCrypt\TrueCrypt.exe" /q /d T
This works too if the drive letter of the container drive is removed. %drive% is replaced then by the volume name which works too.
Unfortunately TrueCrypt needs its drive letter for unmounting. It cannot unmount a container by its name even this should be no problem. Ask the TrueCrypt guys...
For complex operations it's better to do the job in a batch file and finally prepare the drive for save removal by means of my command-line tool RemoveDrive:
http://www.uwe-sieber.de/files/removedrive.zip
Sample to kill a process running on the drive to remove and wait a bit:
[OnRemovalRequest]
Letter=X
open=tskill MyProcess
afterdelay=2000
Killing a process is bad. The more friendly way is to send a WM_CLOSE message to the application window. USBDLM can find the window depending on its window text and (optionally) its class name. In case the application needs some additional time to completely close after the main windows is gone, an "after delay" of up to 5 Seconds can be specified.
Sample to find and close the Windows Calculator (the calc.exe) and wait 2 Seconds after sending WM_CLOSE:
[OnRemovalRequest]
Letter=X
CloseWindowText=Calc
CloseWindowClass=SciCalc
afterdelay=2000
Wildcards can be used when the windows text depends on the opened document:
[OnRemovalRequest]
Letter=X
CloseWindowText=* - Notepad
CloseWindowClass=Notepad
afterdelay=2000
The window class can be determined by means of my tool WinInfo:
http://www.uwe-sieber.de/files/wininfo.zip
2. On fail of the safe removal
When the drive to prepare for safe removal is still accessed then the safe removal fails. For instance a just deleted share can be restored then:
[OnRemovalFailed]
Letter=U
open=net share FlashDrive_U=U:\
3. After removal
Sample: Drive A: has been removed, another drive shall be mounted to A:
[OnRemoval]
Letter=A
open=mountvol A: \\?\Volume{433619ea-c6ea-11d9-a3b2-806d6172696f}\
system=1
MountVol is a command-line tool which comes with Windows 2000 and higher.
system=1 makes USBDLM execute it in the System context to give it the required privileges in case the user isn't an admin. It's invisible then.
Furthermore, since V5.2.5 there are OnSafeRemoval and OnUnsafeRemoval, but only for real volumes and not for virtual ones as TrueCrypt volumes. Sample:
[OnUnsafeRemoval]
open="%WinDir%\System32\mplay32.exe" /play /close "%WinDir%\Media\chord.wav"
windowstyle=hidden
mplay32.exe was available up to XP only, since Windows 7 you need a 3rd party tool or the powershell to play a WAV without ending up with a open player.
Or use USBDLM_usr.exe to show a messagebox:
[OnUnsafeRemoval]
open="%USBDLMPATH%\USBDLM_usr.exe" -msgbox -type:0 -icon:0x30 -title:Warning -text:%BusType% device %FriendlyName% was unsafely removed. This is not safe!
Limitation
All these removal events are triggered only if the volume was present for at least 5 Seconds.