Manual

Add a log partition to a Fedora live USB stick

This adds a third partition, exFAT, label LOGS, in the free space a Fedora live image leaves on a USB stick; the live session mounts it read-write at /run/media/liveuser/LOGS, so scripts and their logs live on the stick, survive a hard power-off, and never touch the laptop's own disk.

Tested on
SanDisk Cruzer Blade 16 GB written with the Fedora 45 KDE live image, partitioned from Windows 11 Pro 10.0.26200 (DiskPart 10.0.26100.1150), used from the Fedora 45 live session (kernel 7.2.11-300.fc45) on an ASUS Zenbook 14 UX3405CA, BIOS 316 (2026-11-11).
Not verified
other Fedora releases or image writers; doing the same from Linux (fdisk, mkfs.exfat); removing the partition again.
Needs
a Fedora live stick larger than the image, a Windows PC with an elevated PowerShell or Command Prompt.
Time
10 minutes.
Risk
diskpart on the wrong disk number destroys that disk's data. On the right disk the image partitions are left alone, but the boot menu's media check fails afterwards (Field notes).

Why I needed it: my first S3 test runs on 2026-11-11 were set to write their logs next to the script on the Windows C: volume. Windows had logged an unexpected shutdown (Kernel-Power 41) at its boot before those runs, and Fast Startup is on, so C: was most likely not clean and Linux mounted it read-only; the script then fell back to /tmp, and the hard power-offs after the two hung runs took /tmp and the logs with it. None of the three runs left a log.

Before you start#

  • Placeholders: <N> is the disk number diskpart gives the stick, <L> the drive letter Windows gives LOGS, <YOU> your Windows account folder, <REPO> the folder that holds your scripts, <SCRIPT> a script name.
  • The stick holds only the live image; nothing on it needs a backup. Do back up any other USB disk that is plugged in, or unplug it, so it cannot be picked by mistake. Do not plug in or unplug any disk between step 1 and the script: diskpart numbers disks in the order it finds them, and the script selects the stick by number.
  • Time stamps: Windows keeps the hardware clock in local time, and the live session reads it as UTC (rtcwake logs assuming RTC uses UTC). So on a laptop that also runs Windows every journal and log stamp from the live session is local time labelled UTC or +00:00; mine are UTC+2. In the live session, timedatectl shows RTC in local TZ: no while the clock really holds local time. Either read the stamps as local time, or, in the live session only, run sudo timedatectl set-local-rtc 1 --adjust-system-clock and set your time zone before logging, and give rtcwake the -l flag [UNVERIFIED: I read the stamps as local time and did not run these].

Steps#

  1. Find the stick's disk number. In an elevated prompt run diskpart, then list disk, and take the number of the disk whose size matches the stick (<N>). Then check it:

    select disk <N>
    detail disk
    

    Expected: the stick's model name, Type : USB and Boot Disk : No (my output is in step 3). If the model is not your stick or Boot Disk says Yes, type exit and start over.

    WarningWrong disk = data loss

    create partition and format act on whatever disk is selected. In a script they run straight after detail disk without stopping, so check the number interactively first. I did not keep my list disk output.

  2. Write the diskpart script as logs-partition.txt, with your <N>:

    select disk <N>
    detail disk
    create partition primary
    format fs=exfat label=LOGS quick
    assign
    list partition
    

    create partition primary without size= takes all the free space after the image.

  3. Run it from the elevated prompt with diskpart /s logs-partition.txt [UNVERIFIED: my exact command line was not kept; the saved output below is the complete output of the script above, with <N> = 1]:

    Microsoft DiskPart version 10.0.26100.1150
    
    Copyright (C) Microsoft Corporation.
    On computer: host
    
    Disk 1 is now the selected disk.
    
    SanDisk Cruzer Blade USB Device
    Disk ID: <DISK_ID>
    Type   : USB
    Status : Online
    Path   : 0
    Target : 0
    LUN ID : 0
    Location Path : UNAVAILABLE
    Current Read-only State : No
    Read-only  : No
    Boot Disk  : No
    Pagefile Disk  : No
    Hibernation File Disk  : No
    Crashdump Disk  : No
    Clustered Disk  : No
    
      Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
      ----------  ---  -----------  -----  ----------  -------  ---------  --------
      Volume 3     D                       Removable   3349 MB  Unusable
    
    DiskPart succeeded in creating the specified partition.
    
    
        0 percent completed
        0 percent completed
      100 percent completed
    
    
    DiskPart successfully formatted the volume.
    
    DiskPart successfully assigned the drive letter or mount point.
    
      Partition ###  Type              Size     Offset
      -------------  ----------------  -------  -------
      Partition 1    Primary           3349 MB    32 KB
      Partition 2    System              30 MB  3349 MB
    * Partition 3    Primary             11 GB  3380 MB
    

    Expected: three partitions, the new one last and selected (*). Partitions 1 and 2 are the live image (Windows lists its main partition as Unusable; leave it so).

  4. Copy your scripts onto LOGS (it now has a drive letter in Windows, <L>). Create the target folder first: New-Item -ItemType Directory <L>:\live-test [UNVERIFIED: how the folder was created on my stick was not recorded; without it Copy-Item fails with "Could not find a part of the path"]. Then I used this PowerShell script, which finds the volume by label, copies five files and compares the first 12 hex digits of each SHA-256; put your own folder and file names in $src and the list:

    # Copy the live-test scripts to the LOGS partition of the Fedora stick and compare hashes.
    $v = Get-Volume -FileSystemLabel LOGS -ErrorAction SilentlyContinue
    if (-not $v) { 'LOGS not mounted'; return }
    $src = 'C:\Users\<YOU>\work\<REPO>\linux\live-test'
    $dst = "$($v.DriveLetter):\live-test"
    foreach ($f in 'ux3405-quick.sh', 'ux3405-online-run.sh', 'ux3405-last-run.sh', 'ux3405-dump.sh', 'ux3405-s3-test.sh') {
        Copy-Item -LiteralPath (Join-Path $src $f) -Destination (Join-Path $dst $f) -Force
        $a = (Get-FileHash (Join-Path $src $f)).Hash.Substring(0, 12)
        $b = (Get-FileHash (Join-Path $dst $f)).Hash.Substring(0, 12)
        '{0,-22} repo {1} stick {2} {3}' -f $f, $a, $b, $(if ($a -eq $b) { 'ok' } else { 'MISMATCH' })
    }
    Get-ChildItem $dst | Select-Object Name, Length | Format-Table -AutoSize | Out-String
    

    Expected: one ok line per file. I did not keep this script's output.

  5. Boot the stick and run from LOGS. In the live session the partition is at /run/media/liveuser/LOGS [UNVERIFIED: whether the session mounted it by itself or when I opened it in Dolphin; the kernel logged the exFAT mount 123 s and 150 s after boot, shortly before my scripts started, which fits a mount on opening it]. Run scripts from there, for example cd /run/media/liveuser/LOGS/live-test and sudo bash <SCRIPT>.sh, and have each script write its log next to itself and sync it before anything risky.

Verify#

The kernel sees three partitions on the stick, and files written in the live session are on LOGS. In the live session, lsblk -o NAME,FSTYPE,LABEL,MOUNTPOINTS lists the third partition as exfat, LOGS, mounted at /run/media/liveuser/LOGS [UNVERIFIED: I did not run it on my boots]. What my logs show instead, from the kernel journal of a later live boot (labelled UTC, really local time: see Before you start) and the first line of a script's summary log, both read back on Windows from LOGS:

Nov 11 16:45:06 fedora kernel:  sda: sda1 sda2 sda3
ux3405-dump 20261111-164731 -> /run/media/liveuser/LOGS/live-test/ux3405-dump-20261111-164731

Undo / rollback#

Remove the partition in diskpart: select disk <N> and detail disk (check it is the stick, as in step 1), list partition (partition 3 is the 11 GB one), then select partition 3, delete partition. To get a stick that passes the boot menu's media check again, write the live image to it again, which replaces the whole layout. [UNVERIFIED: rollback not exercised]

Failure modes#

Symptom (exact message)CauseFix
Log missing after a hard power-off; a script with a /tmp fallback like mine prints log dir not writable, logging to /tmp/...The log folder was on a volume Linux mounted read-only (here: Windows C: after an unclean Windows shutdown), so the log went to /tmp, which a power-off erases. The read-only mount is my inference: no log survived to show itRun from LOGS, or boot Linux only after a Windows Restart if C: must be used
exFAT-fs (sda3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.LOGS was not unmounted at the end of the previous boot (on my 16:45 boot, local time: a hard power-off after a hung S3 run; how the boot before my 18:17 boot ended is not recorded)None needed on my runs: the synced logs read fine on Windows afterwards
Boot menu "Test this media" check fails (message not recorded)Most likely the extra partition: the stick no longer matches what the check expects [UNVERIFIED]Skip the media check; check the ISO hash before writing the stick instead

Field notes#

  • 2026-11-11, SanDisk Cruzer Blade 16 GB, Fedora 45 KDE live (kernel 7.2.11-300.fc45) on an ASUS Zenbook 14 UX3405CA (BIOS 316), DiskPart 10.0.26100.1150 on Windows 11 Pro 10.0.26200:
    • Afternoon: three S3 test runs (two suspends, one after-hang check) left no log anywhere, as described at the top.
    • About 16:10 local time (UTC+2) I ran the diskpart script above. Before create, Windows listed only the image's 3349 MB partition, as D: and Unusable; afterwards LOGS got the rest, 11 GB at offset 3380 MB.
    • Both later boots I have kernel journals for saw sda1 sda2 sda3, and every later run that day (the dump, online and quick scripts and six more S3 runs) wrote their logs to /run/media/liveuser/LOGS/live-test. All six S3 runs hung and ended in a hard power-off; their logs, synced before the suspend, were all on the stick afterwards.
    • The two later boots that I have kernel journals for each printed the exFAT "not properly unmounted" warning when LOGS was mounted; the logs from those boots read fine on Windows afterwards.
    • After the partition was added, the boot menu's "Test this media" check failed. I did not keep its message.

Notes#

  • Doing it from Linux with fdisk and mkfs.exfat should work the same way; not verified.
  • The first Fedora live run on this laptop, before the stick had LOGS: Fedora live USB check on the UX3405CA.

Filed under: fedora, linux, windows, storage

Sources#

  • My diskpart script and its saved output, 2026-11-11 (Disk ID and computer name replaced).
  • Kernel journals and script logs from the 2026-11-11 live boots, copied off LOGS.