Add a log partition to a Fedora live USB stick
Contents
This adds a third partition, exFAT, label LOGS, in the free space a Fedora live image leaves on a USB stick; the live session mounts it read-write at /run/media/liveuser/LOGS, so scripts and their logs live on the stick, survive a hard power-off, and never touch the laptop's own disk.
- Tested on
- SanDisk Cruzer Blade 16 GB written with the Fedora 45 KDE live image, partitioned from Windows 11 Pro 10.0.26200 (DiskPart 10.0.26100.1150), used from the Fedora 45 live session (kernel 7.2.11-300.fc45) on an ASUS Zenbook 14 UX3405CA, BIOS 316 (2026-11-11).
- Not verified
- other Fedora releases or image writers; doing the same from Linux (
fdisk,mkfs.exfat); removing the partition again. - Needs
- a Fedora live stick larger than the image, a Windows PC with an elevated PowerShell or Command Prompt.
- Time
- 10 minutes.
- Risk
diskparton the wrong disk number destroys that disk's data. On the right disk the image partitions are left alone, but the boot menu's media check fails afterwards (Field notes).
Why I needed it: my first S3 test runs on 2026-11-11 were set to write their logs next to the script on the Windows C: volume. Windows had logged an unexpected shutdown (Kernel-Power 41) at its boot before those runs, and Fast Startup is on, so C: was most likely not clean and Linux mounted it read-only; the script then fell back to /tmp, and the hard power-offs after the two hung runs took /tmp and the logs with it. None of the three runs left a log.
Before you start#
- Placeholders:
<N>is the disk number diskpart gives the stick,<L>the drive letter Windows givesLOGS,<YOU>your Windows account folder,<REPO>the folder that holds your scripts,<SCRIPT>a script name. - The stick holds only the live image; nothing on it needs a backup. Do back up any other USB disk that is plugged in, or unplug it, so it cannot be picked by mistake. Do not plug in or unplug any disk between step 1 and the script: diskpart numbers disks in the order it finds them, and the script selects the stick by number.
- Time stamps: Windows keeps the hardware clock in local time, and the live session reads it as UTC (
rtcwakelogsassuming RTC uses UTC). So on a laptop that also runs Windows every journal and log stamp from the live session is local time labelled UTC or+00:00; mine are UTC+2. In the live session,timedatectlshowsRTC in local TZ: nowhile the clock really holds local time. Either read the stamps as local time, or, in the live session only, runsudo timedatectl set-local-rtc 1 --adjust-system-clockand set your time zone before logging, and givertcwakethe-lflag [UNVERIFIED: I read the stamps as local time and did not run these].
Steps#
Find the stick's disk number. In an elevated prompt run
diskpart, thenlist disk, and take the number of the disk whose size matches the stick (<N>). Then check it:select disk <N> detail diskExpected: the stick's model name,
Type : USBandBoot Disk : No(my output is in step 3). If the model is not your stick orBoot DisksaysYes, typeexitand start over.WarningWrong disk = data loss
create partitionandformatact on whatever disk is selected. In a script they run straight afterdetail diskwithout stopping, so check the number interactively first. I did not keep mylist diskoutput.Write the diskpart script as
logs-partition.txt, with your<N>:select disk <N> detail disk create partition primary format fs=exfat label=LOGS quick assign list partitioncreate partition primarywithoutsize=takes all the free space after the image.Run it from the elevated prompt with
diskpart /s logs-partition.txt[UNVERIFIED: my exact command line was not kept; the saved output below is the complete output of the script above, with<N>= 1]:Microsoft DiskPart version 10.0.26100.1150 Copyright (C) Microsoft Corporation. On computer: host Disk 1 is now the selected disk. SanDisk Cruzer Blade USB Device Disk ID: <DISK_ID> Type : USB Status : Online Path : 0 Target : 0 LUN ID : 0 Location Path : UNAVAILABLE Current Read-only State : No Read-only : No Boot Disk : No Pagefile Disk : No Hibernation File Disk : No Crashdump Disk : No Clustered Disk : No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 3 D Removable 3349 MB Unusable DiskPart succeeded in creating the specified partition. 0 percent completed 0 percent completed 100 percent completed DiskPart successfully formatted the volume. DiskPart successfully assigned the drive letter or mount point. Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 3349 MB 32 KB Partition 2 System 30 MB 3349 MB * Partition 3 Primary 11 GB 3380 MBExpected: three partitions, the new one last and selected (
*). Partitions 1 and 2 are the live image (Windows lists its main partition asUnusable; leave it so).Copy your scripts onto
LOGS(it now has a drive letter in Windows,<L>). Create the target folder first:New-Item -ItemType Directory <L>:\live-test[UNVERIFIED: how the folder was created on my stick was not recorded; without itCopy-Itemfails with "Could not find a part of the path"]. Then I used this PowerShell script, which finds the volume by label, copies five files and compares the first 12 hex digits of each SHA-256; put your own folder and file names in$srcand the list:# Copy the live-test scripts to the LOGS partition of the Fedora stick and compare hashes. $v = Get-Volume -FileSystemLabel LOGS -ErrorAction SilentlyContinue if (-not $v) { 'LOGS not mounted'; return } $src = 'C:\Users\<YOU>\work\<REPO>\linux\live-test' $dst = "$($v.DriveLetter):\live-test" foreach ($f in 'ux3405-quick.sh', 'ux3405-online-run.sh', 'ux3405-last-run.sh', 'ux3405-dump.sh', 'ux3405-s3-test.sh') { Copy-Item -LiteralPath (Join-Path $src $f) -Destination (Join-Path $dst $f) -Force $a = (Get-FileHash (Join-Path $src $f)).Hash.Substring(0, 12) $b = (Get-FileHash (Join-Path $dst $f)).Hash.Substring(0, 12) '{0,-22} repo {1} stick {2} {3}' -f $f, $a, $b, $(if ($a -eq $b) { 'ok' } else { 'MISMATCH' }) } Get-ChildItem $dst | Select-Object Name, Length | Format-Table -AutoSize | Out-StringExpected: one
okline per file. I did not keep this script's output.Boot the stick and run from
LOGS. In the live session the partition is at/run/media/liveuser/LOGS[UNVERIFIED: whether the session mounted it by itself or when I opened it in Dolphin; the kernel logged the exFAT mount 123 s and 150 s after boot, shortly before my scripts started, which fits a mount on opening it]. Run scripts from there, for examplecd /run/media/liveuser/LOGS/live-testandsudo bash <SCRIPT>.sh, and have each script write its log next to itself andsyncit before anything risky.
Verify#
The kernel sees three partitions on the stick, and files written in the live session are on LOGS. In the live session, lsblk -o NAME,FSTYPE,LABEL,MOUNTPOINTS lists the third partition as exfat, LOGS, mounted at /run/media/liveuser/LOGS [UNVERIFIED: I did not run it on my boots]. What my logs show instead, from the kernel journal of a later live boot (labelled UTC, really local time: see Before you start) and the first line of a script's summary log, both read back on Windows from LOGS:
Nov 11 16:45:06 fedora kernel: sda: sda1 sda2 sda3
ux3405-dump 20261111-164731 -> /run/media/liveuser/LOGS/live-test/ux3405-dump-20261111-164731
Undo / rollback#
Remove the partition in diskpart: select disk <N> and detail disk (check it is the stick, as in step 1), list partition (partition 3 is the 11 GB one), then select partition 3, delete partition. To get a stick that passes the boot menu's media check again, write the live image to it again, which replaces the whole layout. [UNVERIFIED: rollback not exercised]
Failure modes#
| Symptom (exact message) | Cause | Fix |
|---|---|---|
Log missing after a hard power-off; a script with a /tmp fallback like mine prints log dir not writable, logging to /tmp/... | The log folder was on a volume Linux mounted read-only (here: Windows C: after an unclean Windows shutdown), so the log went to /tmp, which a power-off erases. The read-only mount is my inference: no log survived to show it | Run from LOGS, or boot Linux only after a Windows Restart if C: must be used |
exFAT-fs (sda3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. | LOGS was not unmounted at the end of the previous boot (on my 16:45 boot, local time: a hard power-off after a hung S3 run; how the boot before my 18:17 boot ended is not recorded) | None needed on my runs: the synced logs read fine on Windows afterwards |
| Boot menu "Test this media" check fails (message not recorded) | Most likely the extra partition: the stick no longer matches what the check expects [UNVERIFIED] | Skip the media check; check the ISO hash before writing the stick instead |
Field notes#
- 2026-11-11, SanDisk Cruzer Blade 16 GB, Fedora 45 KDE live (kernel 7.2.11-300.fc45) on an ASUS Zenbook 14 UX3405CA (BIOS 316), DiskPart 10.0.26100.1150 on Windows 11 Pro 10.0.26200:
- Afternoon: three S3 test runs (two suspends, one after-hang check) left no log anywhere, as described at the top.
- About 16:10 local time (UTC+2) I ran the diskpart script above. Before
create, Windows listed only the image's 3349 MB partition, asD:andUnusable; afterwardsLOGSgot the rest, 11 GB at offset 3380 MB. - Both later boots I have kernel journals for saw
sda1 sda2 sda3, and every later run that day (the dump, online and quick scripts and six more S3 runs) wrote their logs to/run/media/liveuser/LOGS/live-test. All six S3 runs hung and ended in a hard power-off; their logs, synced before the suspend, were all on the stick afterwards. - The two later boots that I have kernel journals for each printed the exFAT "not properly unmounted" warning when
LOGSwas mounted; the logs from those boots read fine on Windows afterwards. - After the partition was added, the boot menu's "Test this media" check failed. I did not keep its message.
Notes#
- Doing it from Linux with
fdiskandmkfs.exfatshould work the same way; not verified. - The first Fedora live run on this laptop, before the stick had
LOGS: Fedora live USB check on the UX3405CA.
Filed under: fedora, linux, windows, storage
Sources#
- My diskpart script and its saved output, 2026-11-11 (Disk ID and computer name replaced).
- Kernel journals and script logs from the 2026-11-11 live boots, copied off
LOGS.