REPORT – Restore USB Access on a Windows 10 VM – v1.1.0

0.0 Executive Summary

This report explains the steps taken to fix USB detection issues and improve USB passthrough for a Windows 10 virtual machine (VM). The goal was to ensure that external USB devices worked reliably and to reduce the risk of data corruption caused by unstable connections or conflicts on the host system.

This issue was resolved by using VirtualBox USB filters instead of manual USB connections. The fix was confirmed using diskpart to verify that the drive was detected and chkdsk logs to confirm that the file system was healthy and accessible.

1.0 Restoring USB Access and Volume Integrity

1.1 Project Description

The goal of this task was to fix the issue where the VM could not detect or use external USB devices.

A structured troubleshooting process was used to:

Set up consistent hardware mapping using USB filters in VirtualBox
Fix resource conflicts caused by open files or processes locking the USB device
Check file system health using Windows Event Viewer logs

This ensures that data transfers using external storage occur on a stable and verified system.

1.2 Technical Task / Troubleshooting Process

The process focused on identifying where the failure occurred in the virtualization setup and applying fixes to restore access.

Key Actions & Observations

Infrastructure Check: The host system detected the USB device, but the VM did not. This indicates a passthrough configuration issue.
Hardware Mapping: VirtualBox USB filters were configured using the device’s Vendor and Product ID so the VM could automatically detect the USB device.
Volume Remediation: Errors such as “Cannot open volume for direct access” were fixed by closing any active handles and running: ‘chkdsk E: /x /f /v’
File System Recovery: In cases where the volume became inaccessible or returned errors (e.g., RAW state or CHKDSK failure), the drive was reformatted and rebuilt using NTFS before validation.

This forced the drive to dismount and perform a full file system check.

Verification of Evidence:
- diskpart was used to confirm the volume was detected and assigned a drive letter
- wevtutil was used to export chkdsk logs from the Event Viewer to confirm the file system was clean

Root Cause: This issue was caused by missing VirtualBox USB filters combined with active file locks or processes on the host system. This prevented the VM from gaining proper access to the USB device.

1.3 Resolution and Validation

Access was restored by setting up USB filters and confirming that the file system was working correctly.

Parameter	Configuration Value
Management Tool	VirtualBox / diskpart / chkdsk
Device State	Connected / Verified
Access Mode	VirtualBox USB passthrough
Scope	Windows 10 VM Hardware Access

Validation Steps

Functional Test: The USB device was reconnected and automatically detected by the VM through the USB filter.
Volume Verification: Running diskpart list volume confirmed the drive (E:) was visible and usable.
Data Integrity Check: A read and write test confirmed the drive worked correctly, and chkdsk completed without reporting errors.
Advanced Integrity Validation: Additional checks using fsutil confirmed the volume was not marked dirty, self-healing was enabled, and no corruption remained.

2.0 Conclusion

2.1 Key Takeaways

USB passthrough depends on correct configuration in the hypervisor layer
Troubleshooting must address both hardware detection and software conflicts
Event Viewer logs help confirm whether file system corruption occurred
Following a step-by-step approach from detection to repair helps avoid misdiagnosing the issue

2.2 Operational Implications & Recommendations

Risk: File System Corruption
Unstable or improper disconnection of USB devices can damage the file system, including the Master File Table (MFT).

Mitigation: Run chkdsk after any passthrough failure.

Risk: Resource Conflicts
Open files or processes on the host system can prevent the VM from accessing USB devices.

Mitigation: Close all programs using the USB drive before connecting it to the VM.

Risk: Silent Volume Corruption
USB passthrough failures can leave the file system in an inconsistent state without immediate detection.

Mitigation: Perform full validation using CHKDSK and FSUTIL before reusing the device.

Best Practices

Use specific USB filters instead of manual connections
Check Event Viewer logs to confirm repair results
Avoid using the USB device on both host and VM at the same time
Follow standard troubleshooting steps to maintain system stability

Framework Alignment

Supports NIST Cybersecurity Framework PR.DS-4 (Capacity and Availability) by ensuring hardware is available and functioning properly
Helps maintain data integrity by verifying storage health before use