# Add a log partition to a Fedora live USB stick

> Use Windows diskpart to add an exFAT LOGS partition after the Fedora live image, so live-session scripts and logs survive hard power-offs.

Published 2026-11-12. HTML version: https://guides.tsvinc.dev/fedora-live-usb-log-partition/


This adds a third partition, exFAT, label `LOGS`, in the free space a Fedora live image leaves on a USB stick; the live session mounts it read-write at `/run/media/liveuser/LOGS`, so scripts and their logs live on the stick, survive a hard power-off, and never touch the laptop's own disk.

> **Scope** — Verified on: SanDisk Cruzer Blade 16 GB written with the Fedora 45 KDE live image, partitioned from Windows 11 Pro 10.0.26200 (DiskPart 10.0.26100.1150), used from the Fedora 45 live session (kernel 7.2.11-300.fc45) on an ASUS Zenbook 14 UX3405CA, BIOS 316 (2026-11-11).
> **Not verified:** other Fedora releases or image writers; doing the same from Linux (`fdisk`, `mkfs.exfat`); removing the partition again.
> **Needs:** a Fedora live stick larger than the image, a Windows PC with an elevated PowerShell or Command Prompt.
> **Time:** 10 minutes. **Risk:** `diskpart` on the wrong disk number destroys that disk's data. On the right disk the image partitions are left alone, but the boot menu's media check fails afterwards (Field notes).

Why I needed it: my first S3 test runs on 2026-11-11 were set to write their logs next to the script on the Windows C: volume. Windows had logged an unexpected shutdown (Kernel-Power 41) at its boot before those runs, and Fast Startup is on, so C: was most likely not clean and Linux mounted it read-only; the script then fell back to `/tmp`, and the hard power-offs after the two hung runs took `/tmp` and the logs with it. None of the three runs left a log.

## Before you start

- Placeholders: `<N>` is the disk number diskpart gives the stick, `<L>` the drive letter Windows gives `LOGS`, `<YOU>` your Windows account folder, `<REPO>` the folder that holds your scripts, `<SCRIPT>` a script name.
- The stick holds only the live image; nothing on it needs a backup. Do back up any other USB disk that is plugged in, or unplug it, so it cannot be picked by mistake. Do not plug in or unplug any disk between step 1 and the script: diskpart numbers disks in the order it finds them, and the script selects the stick by number.
- Time stamps: Windows keeps the hardware clock in local time, and the live session reads it as UTC (`rtcwake` logs `assuming RTC uses UTC`). So on a laptop that also runs Windows every journal and log stamp from the live session is local time labelled UTC or `+00:00`; mine are UTC+2. In the live session, `timedatectl` shows `RTC in local TZ: no` while the clock really holds local time. Either read the stamps as local time, or, in the live session only, run `sudo timedatectl set-local-rtc 1 --adjust-system-clock` and set your time zone before logging, and give `rtcwake` the `-l` flag [UNVERIFIED: I read the stamps as local time and did not run these].

## Steps

1. **Find the stick's disk number.** In an elevated prompt run `diskpart`, then `list disk`, and take the number of the disk whose size matches the stick (`<N>`). Then check it:

   ```text
   select disk <N>
   detail disk
   ```

   Expected: the stick's model name, `Type   : USB` and `Boot Disk  : No` (my output is in step 3). If the model is not your stick or `Boot Disk` says `Yes`, type `exit` and start over.

   > [!WARNING] Wrong disk = data loss
   > `create partition` and `format` act on whatever disk is selected. In a script they run straight after `detail disk` without stopping, so check the number interactively first. I did not keep my `list disk` output.

2. **Write the diskpart script** as `logs-partition.txt`, with your `<N>`:

   ```text
   select disk <N>
   detail disk
   create partition primary
   format fs=exfat label=LOGS quick
   assign
   list partition
   ```

   `create partition primary` without `size=` takes all the free space after the image.

3. **Run it from the elevated prompt** with `diskpart /s logs-partition.txt` [UNVERIFIED: my exact command line was not kept; the saved output below is the complete output of the script above, with `<N>` = 1]:

   ```text
   Microsoft DiskPart version 10.0.26100.1150

   Copyright (C) Microsoft Corporation.
   On computer: host

   Disk 1 is now the selected disk.

   SanDisk Cruzer Blade USB Device
   Disk ID: <DISK_ID>
   Type   : USB
   Status : Online
   Path   : 0
   Target : 0
   LUN ID : 0
   Location Path : UNAVAILABLE
   Current Read-only State : No
   Read-only  : No
   Boot Disk  : No
   Pagefile Disk  : No
   Hibernation File Disk  : No
   Crashdump Disk  : No
   Clustered Disk  : No

     Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
     ----------  ---  -----------  -----  ----------  -------  ---------  --------
     Volume 3     D                       Removable   3349 MB  Unusable

   DiskPart succeeded in creating the specified partition.


       0 percent completed
       0 percent completed
     100 percent completed


   DiskPart successfully formatted the volume.

   DiskPart successfully assigned the drive letter or mount point.

     Partition ###  Type              Size     Offset
     -------------  ----------------  -------  -------
     Partition 1    Primary           3349 MB    32 KB
     Partition 2    System              30 MB  3349 MB
   * Partition 3    Primary             11 GB  3380 MB
   ```

   Expected: three partitions, the new one last and selected (`*`). Partitions 1 and 2 are the live image (Windows lists its main partition as `Unusable`; leave it so).

4. **Copy your scripts onto `LOGS`** (it now has a drive letter in Windows, `<L>`). Create the target folder first: `New-Item -ItemType Directory <L>:\live-test` [UNVERIFIED: how the folder was created on my stick was not recorded; without it `Copy-Item` fails with "Could not find a part of the path"]. Then I used this PowerShell script, which finds the volume by label, copies five files and compares the first 12 hex digits of each SHA-256; put your own folder and file names in `$src` and the list:

   ```powershell
   # Copy the live-test scripts to the LOGS partition of the Fedora stick and compare hashes.
   $v = Get-Volume -FileSystemLabel LOGS -ErrorAction SilentlyContinue
   if (-not $v) { 'LOGS not mounted'; return }
   $src = 'C:\Users\<YOU>\work\<REPO>\linux\live-test'
   $dst = "$($v.DriveLetter):\live-test"
   foreach ($f in 'ux3405-quick.sh', 'ux3405-online-run.sh', 'ux3405-last-run.sh', 'ux3405-dump.sh', 'ux3405-s3-test.sh') {
       Copy-Item -LiteralPath (Join-Path $src $f) -Destination (Join-Path $dst $f) -Force
       $a = (Get-FileHash (Join-Path $src $f)).Hash.Substring(0, 12)
       $b = (Get-FileHash (Join-Path $dst $f)).Hash.Substring(0, 12)
       '{0,-22} repo {1} stick {2} {3}' -f $f, $a, $b, $(if ($a -eq $b) { 'ok' } else { 'MISMATCH' })
   }
   Get-ChildItem $dst | Select-Object Name, Length | Format-Table -AutoSize | Out-String
   ```

   Expected: one `ok` line per file. I did not keep this script's output.

5. **Boot the stick and run from `LOGS`.** In the live session the partition is at `/run/media/liveuser/LOGS` [UNVERIFIED: whether the session mounted it by itself or when I opened it in Dolphin; the kernel logged the exFAT mount 123 s and 150 s after boot, shortly before my scripts started, which fits a mount on opening it]. Run scripts from there, for example `cd /run/media/liveuser/LOGS/live-test` and `sudo bash <SCRIPT>.sh`, and have each script write its log next to itself and `sync` it before anything risky.

## Verify

The kernel sees three partitions on the stick, and files written in the live session are on `LOGS`. In the live session, `lsblk -o NAME,FSTYPE,LABEL,MOUNTPOINTS` lists the third partition as `exfat`, `LOGS`, mounted at `/run/media/liveuser/LOGS` [UNVERIFIED: I did not run it on my boots]. What my logs show instead, from the kernel journal of a later live boot (labelled UTC, really local time: see Before you start) and the first line of a script's summary log, both read back on Windows from `LOGS`:

```text
Nov 11 16:45:06 fedora kernel:  sda: sda1 sda2 sda3
```

```text
ux3405-dump 20261111-164731 -> /run/media/liveuser/LOGS/live-test/ux3405-dump-20261111-164731
```

## Undo / rollback

Remove the partition in diskpart: `select disk <N>` and `detail disk` (check it is the stick, as in step 1), `list partition` (partition 3 is the 11 GB one), then `select partition 3`, `delete partition`. To get a stick that passes the boot menu's media check again, write the live image to it again, which replaces the whole layout. [UNVERIFIED: rollback not exercised]

## Failure modes

| Symptom (exact message) | Cause | Fix |
|---|---|---|
| Log missing after a hard power-off; a script with a `/tmp` fallback like mine prints `log dir not writable, logging to /tmp/...` | The log folder was on a volume Linux mounted read-only (here: Windows C: after an unclean Windows shutdown), so the log went to `/tmp`, which a power-off erases. The read-only mount is my inference: no log survived to show it | Run from `LOGS`, or boot Linux only after a Windows Restart if C: must be used |
| `exFAT-fs (sda3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.` | `LOGS` was not unmounted at the end of the previous boot (on my 16:45 boot, local time: a hard power-off after a hung S3 run; how the boot before my 18:17 boot ended is not recorded) | None needed on my runs: the synced logs read fine on Windows afterwards |
| Boot menu "Test this media" check fails (message not recorded) | Most likely the extra partition: the stick no longer matches what the check expects [UNVERIFIED] | Skip the media check; check the ISO hash before writing the stick instead |

## Field notes

- **2026-11-11, SanDisk Cruzer Blade 16 GB, Fedora 45 KDE live (kernel 7.2.11-300.fc45) on an ASUS Zenbook 14 UX3405CA (BIOS 316), DiskPart 10.0.26100.1150 on Windows 11 Pro 10.0.26200:**
  - Afternoon: three S3 test runs (two suspends, one after-hang check) left no log anywhere, as described at the top.
  - About 16:10 local time (UTC+2) I ran the diskpart script above. Before `create`, Windows listed only the image's 3349 MB partition, as `D:` and `Unusable`; afterwards `LOGS` got the rest, 11 GB at offset 3380 MB.
  - Both later boots I have kernel journals for saw `sda1 sda2 sda3`, and every later run that day (the dump, online and quick scripts and six more S3 runs) wrote their logs to `/run/media/liveuser/LOGS/live-test`. All six S3 runs hung and ended in a hard power-off; their logs, synced before the suspend, were all on the stick afterwards.
  - The two later boots that I have kernel journals for each printed the exFAT "not properly unmounted" warning when `LOGS` was mounted; the logs from those boots read fine on Windows afterwards.
  - After the partition was added, the boot menu's "Test this media" check failed. I did not keep its message.

## Notes

- Doing it from Linux with `fdisk` and `mkfs.exfat` should work the same way; not verified.
- The first Fedora live run on this laptop, before the stick had `LOGS`: [Fedora live USB check on the UX3405CA](https://tsvinc.dev/posts/ux3405ca-linux-live-usb-check/).

## Sources

- My diskpart script and its saved output, 2026-11-11 (Disk ID and computer name replaced).
- Kernel journals and script logs from the 2026-11-11 live boots, copied off `LOGS`.