Rufus 4.5+ not making a proper uefi:ntfs partition

[sunkan53]

<!-- PLEASE READ THIS CAREFULLY:

1. You MUST read and complete the steps from the checklist below, by placing an x into each [ ] (so that it shows '[x]', NOT '[ x]' or '[x ]'), BEFORE clicking on 'Submit new issue'.

2. Failure to perform these steps, WHICH ARE ONLY THERE TO HELP YOU, will usually result in your issue being dismissed without notice.

3. If you are reporting an issue when trying to run Rufus, or when trying to boot a media created by Rufus, you MUST provide a log, period. Please do not assume that the developer(s) will be able to "guess" the specifics of your environment, what image you used, what type of media you used it with or the many many other critical parameters that the log provides data for. To investigate an issue, a log from Rufus is ALWAYS required.

4. If you still choose not to provide a log when reporting a problem, you agree that your issue will be closed without any further investigation.

YOU HAVE BEEN WARNED. -->

Checklist

• [x] I have been made aware that if my problem can be summarized as "I've created or tried to create a media using Rufus, and ...", and I am not including a log, this issue will be summarily closed.
• [x] I looked at https://github.com/pbatard/rufus/wiki/FAQ to see if my question has already been answered.
• [x] I performed a search in the issue tracker for similar issues using keywords relevant to my problem, such as the error message I got from the log.
• [x] I clicked the 'Log' button (🗒️) or pressed Ctrl-L in Rufus, or used DebugView, and copy/pasted the log into the section that says <FULL LOG> below.
• [x] The log I am copying is the FULL log, starting with the line Rufus version: x.y.z - I have NOT removed any part of it.

Additionally (if applicable):

• [x] I ran a bad blocks check, by clicking Show advanced format options then Check device for bad blocks, and confirmed that my USB is not defective.
• [x] I also tried one or more of the following:
  • [x] Using a different USB drive.
  • [x] Plugging the USB into a different port.
  • [x] Running Rufus on a different computer.
• [x] If using an image, I clicked on the (✓) button to compute the MD5, SHA1 and SHA256 checksums, which are therefore present in the log I copied. I confirmed, by performing an internet search, that these values match the ones from the official image.

Issue description

When I try to create a bootable usb on Rufus 4.5 and higher, bootable usb is not available as a boot option in uefi. Seems like it formats UEFI:NTFS as RAW filesystem. Rufus 4.4 formats it in FAT12, so it is recognizable in boot menu.

As you can see in the log, used version is 4.6 beta and right before it made a bootable usb in version 4.4. After running it on 4.6 and 4.5 included, it gets formatted to RAW.

Log

Character limit was exceeded, so I attached a file rufus.log

[pbatard]

Your issue is clearly environmental, as I'm not seeing this at all, testing in the same conditions as you, with the same ISO, and on a similar sized drive.

Also, if this was a widespread issue, I'd have had scores of issues similar to yours in this issue tracker, since the release of Rufus 4.5 in May, as Rufus is downloaded close to 3 million times each month (and a lot of these will be for the creation of Windows installation drive that do require UEFI:NTFS, so if Rufus systematically failed to create the UEFI:NTFS partition, it would be obvious by now).

Here is the relevant excerpt from my log:

Rufus x64 v4.6.2205 (Beta)
Windows version: Windows 11 Pro for Workstations x64 (Build 26100.2033)
Syslinux versions: 4.07/2013-07-25, 6.04/pre1
Grub versions: 0.4.6a, 2.12
System locale ID: 0x0809 (en-GB)
Will use default UI locale 0x0809
SetLGP: Successfully set NoDriveTypeAutorun policy to 0x0000009E
Localization set to 'en-US'
Found 517 revoked UEFI bootloaders from embedded list
Found USB device 'SanDisk Extreme USB Device' (0781:5580) [ID]
Using 'autorun.inf' label for drive F: 'Ubuntu 24.04 LTS amd64'
1 device found
Disk type: Removable, Disk size: 16 GB, Sector size: 512 bytes
Cylinders: 1946, Tracks per cylinder: 255, Sectors per track: 63
Partition type: GPT, NB Partitions: 2
Disk GUID: {77181C81-DC23-4CEE-AF7E-6D59B8862062}
Max parts: 128, Start Offset: 17408, Usable = 16013908480 bytes
Partition 1:
  Type: Microsoft Basic Data Partition
  Name: 'Main Data Partition'
  Detected File System: NTFS
  ID: {425361C5-B29E-475D-91C4-4B25E5AEEE10}
  Size: 14.9 GB (16011780096 bytes)
  Start Sector: 2048, Attributes: 0x0000000000000000
Partition 2 (UEFI:NTFS):
  Type: Microsoft Basic Data Partition
  Name: 'UEFI:NTFS'
  Detected File System: FAT12
  ID: {BAA37449-DE71-493D-8730-E739FD2EFEA1}
  Size: 1 MB (1064448 bytes)
  Start Sector: 31275090, Attributes: 0x9000000000000000
Found 5 additional UEFI revocation filters from remote SBAT
Scanning image...
ISO analysis:
  Image is a UDF image
Disk image analysis:
  Image does not have a Boot Marker
ISO label: 'CCCOMA_X64FRE_EN-US_DV9'
  Detected: Windows 11 ISO (Build 26100.1742)
  Size: 5.4 GB (Projected)
  Has a >4GB file
  Uses: EFI
  Uses: Bootmgr (BIOS and UEFI)
  Uses: Install.wim (version 0.13.1)
Using image: en-us_windows_11_consumer_editions_version_24h2_x64_dvd_1d5fcad3.iso (5.4 GB)
Selected Windows User Experience options:
• Bypass SB/TPM/RAM
• Bypass online account requirement
• Disable data collection

Format operation started
Requesting disk access...
Will use 'F:' as volume mountpoint
Opened \\.\PhysicalDrive7 for shared write access
Analyzing existing boot records...
Drive has a Zeroed Master Boot Record
Clearing MBR/PBR/GPT structures...
Erasing 128 sectors
Initializing disk...
Partitioning (GPT)...
● Creating Main Data Partition (offset: 1048576, size: 14.9 GB)
● Creating UEFI:NTFS Partition (offset: 16012846080, size: 1 MB)
Writing UEFI:NTFS data...
Waiting for logical drive to reappear...
Formatting to NTFS (using IFS)
Using cluster size: 4096 bytes
Quick format was selected
Creating file system...
Format completed.
Opened \\.\PhysicalDrive7 for shared write access
Writing Master Boot Record...
Using Rufus protective MBR
Writing protective message SBR
Found volume \\?\Volume{c342d7f2-4601-43d0-85a8-4f1a88d63855}\
Disabling file indexing...
Successfully remounted \\?\Volume{c342d7f2-4601-43d0-85a8-4f1a88d63855}\ as F:
Extracting files...
Image is a UDF image
Extracting: F:\autorun.inf (128 bytes)
Extracting: F:\boot\bcd (16 KB)
Extracting: F:\boot\boot.sdi (3 MB)
Extracting: F:\boot\bootfix.bin (1 KB)
Extracting: F:\boot\bootsect.exe (109.4 KB)
Extracting: F:\boot\en-us\bootsect.exe.mui (16 KB)
Extracting: F:\boot\etfsboot.com (4 KB)
Extracting: F:\boot\fonts\chs_boot.ttf (3.5 MB)
Extracting: F:\boot\fonts\cht_boot.ttf (3.7 MB)
Extracting: F:\boot\fonts\jpn_boot.ttf (1.9 MB)
Extracting: F:\boot\fonts\kor_boot.ttf (2.3 MB)
Extracting: F:\boot\fonts\malgun_boot.ttf (197.3 KB)
Extracting: F:\boot\fonts\malgun_console.ttf (81.4 KB)
Extracting: F:\boot\fonts\malgunn_boot.ttf (194.8 KB)
Extracting: F:\boot\fonts\meiryo_boot.ttf (171.9 KB)
Extracting: F:\boot\fonts\meiryo_console.ttf (90.4 KB)
Extracting: F:\boot\fonts\meiryon_boot.ttf (170 KB)
Extracting: F:\boot\fonts\msjh_boot.ttf (196.5 KB)
Extracting: F:\boot\fonts\msjh_console.ttf (200.1 KB)
Extracting: F:\boot\fonts\msjhn_boot.ttf (194.5 KB)
Extracting: F:\boot\fonts\msyh_boot.ttf (185.4 KB)
Extracting: F:\boot\fonts\msyh_console.ttf (96.3 KB)
Extracting: F:\boot\fonts\msyhn_boot.ttf (183.6 KB)
Extracting: F:\boot\fonts\segmono_boot.ttf (44.8 KB)
Extracting: F:\boot\fonts\segoe_slboot.ttf (100.6 KB)
Extracting: F:\boot\fonts\segoen_slboot.ttf (100.2 KB)
Extracting: F:\boot\fonts\wgl4_boot.ttf (48.9 KB)
Extracting: F:\boot\memtest.exe (1.1 MB)
Extracting: F:\boot\resources\bootres.dll (165.3 KB)
Extracting: F:\boot\resources\bootres_hci.dll (109.3 KB)
Extracting: F:\bootmgr (462.3 KB)
Extracting: F:\bootmgr.efi (2.6 MB)

(...)

Extracting: F:\support\logging\actionqueueetw.dll (21.6 KB)
Extracting: F:\support\logging\auditetw.dll (25.6 KB)
Extracting: F:\support\logging\cmisetupetw.dll (25.4 KB)
Extracting: F:\support\logging\en-us\actionqueueetw.dll.mui (3.5 KB)
Extracting: F:\support\logging\etwproviderinstall.vbs (6.7 KB)
Extracting: F:\support\logging\microsoft-windows-actionqueue-instrumentation.man (6.2 KB)
Extracting: F:\support\logging\microsoft-windows-audit-instrumentation.man (6.6 KB)
Extracting: F:\support\logging\microsoft-windows-cmisetup-instrumentation.man (7.1 KB)
Extracting: F:\support\logging\microsoft-windows-oobeldr-instrumentation.man (8.4 KB)
Extracting: F:\support\logging\microsoft-windows-setup-events.man (19.9 KB)
Extracting: F:\support\logging\microsoft-windows-setup-instrumentation.man (9.0 KB)
Extracting: F:\support\logging\microsoft-windows-setupcl-instrumentation.man (15 KB)
Extracting: F:\support\logging\microsoft-windows-setupugc-instrumentation.man (7.1 KB)
Extracting: F:\support\logging\microsoft-windows-sysprep-instrumentation.man (13.5 KB)
Extracting: F:\support\logging\microsoft-windows-windeploy-instrumentation.man (9 KB)
Extracting: F:\support\logging\oobeldretw.dll (25.4 KB)
Extracting: F:\support\logging\setupcletw.dll (29.5 KB)
Extracting: F:\support\logging\setupetw.dll (29.4 KB)
Extracting: F:\support\logging\setupugcetw.dll (25.4 KB)
Extracting: F:\support\logging\sysprepetw.dll (29.4 KB)
Extracting: F:\support\logging\windeployetw.dll (25.5 KB)
Extracting: F:\support\logging\winsetupetw.dll (73.5 KB)
Applying Windows customization:
Created 'F:\sources\appraiserres.dll' placeholder
Renamed 'F:\setup.exe' → 'F:\setup.dll'
Created 'F:\setup.exe' bypass wrapper (from embedded)
Mounting 'F:\sources\boot.wim[2]'...
Mounted 'F:\sources\boot.wim [2]' on 'C:\Users\nil\AppData\Local\Temp\Ruf6D9A.tmp'
Mounted offline registry hive 'C:\Users\nil\AppData\Local\Temp\Ruf6D9A.tmp\Windows\System32\config\SYSTEM' to 'HKLM\RUFUS_OFFLINE_HIVE'
Created 'HKLM\SYSTEM\Setup\LabConfig\BypassTPMCheck' registry key
Created 'HKLM\SYSTEM\Setup\LabConfig\BypassSecureBootCheck' registry key
Created 'HKLM\SYSTEM\Setup\LabConfig\BypassRAMCheck' registry key
Created 'F:\sources\$OEM$\$$\Panther\unattend.xml'
Unmounted offline registry hive 'HKLM\RUFUS_OFFLINE_HIVE'
Unmounting 'F:\sources\boot.wim[2]'...
Unmounted 'C:\Users\nil\AppData\Local\Temp\Ruf6D9A.tmp [2]'
Finalizing, please wait...
F:autorun.inf already exists - keeping it
NTFS Fixup (Checkdisk)...
Volume label is CCCOMA_X64FRE_EN-US_DV9.

Stage 1: Examining basic file system structure ...
  1280 file records processed.
File verification completed.
 Phase duration (File record verification): 30.70 milliseconds.
  0 large file records processed.
 Phase duration (Orphan file record recovery): 0.77 milliseconds.
  0 bad file records processed.
 Phase duration (Bad file record checking): 0.76 milliseconds.

Stage 2: Examining file name linkage ...
  1496 index entries processed.
Index verification completed.
 Phase duration (Index verification): 100.47 milliseconds.
 Phase duration (Orphan reconnection): 0.32 milliseconds.
 Phase duration (Orphan recovery to lost and found): 0.03 milliseconds.
  0 reparse records processed.
  0 reparse records processed.
 Phase duration (Reparse point and Object ID verification): 1.62 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
 Phase duration (Security descriptor verification): 4.36 milliseconds.
  108 data files processed.
 Phase duration (Data attribute verification): 0.72 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

  15636503 KB total disk space.
   5700152 KB in 978 files.
       384 KB in 110 indexes.
     25311 KB in use by the system.
     23136 KB occupied by the log file.
   9910656 KB available on disk.
      4096 bytes in each allocation unit.
   3909125 total allocation units on disk.
   2477664 allocation units available on disk.
Total duration: 141.32 milliseconds (141 ms).
NTFS Fixup completed.

Found USB device 'SanDisk Extreme USB Device' (0781:5580) [ID]
1 device found
Disk type: Removable, Disk size: 16 GB, Sector size: 512 bytes
Cylinders: 1946, Tracks per cylinder: 255, Sectors per track: 63
Partition type: GPT, NB Partitions: 2
Disk GUID: {24BB7340-9E68-423C-9F19-0F75CA866800}
Max parts: 128, Start Offset: 17408, Usable = 16013908480 bytes
Partition 1:
  Type: Microsoft Basic Data Partition
  Name: 'Main Data Partition'
  Detected File System: NTFS
  ID: {C342D7F2-4601-43D0-85A8-4F1A88D63855}
  Size: 14.9 GB (16011780096 bytes)
  Start Sector: 2048, Attributes: 0x0000000000000000
Partition 2 (UEFI:NTFS):
  Type: Microsoft Basic Data Partition
  Name: 'UEFI:NTFS'
  Detected File System: FAT12
  ID: {113336F2-DCB7-4189-973B-69ACE60A49D1}
  Size: 1 MB (1064448 bytes)
  Start Sector: 31275090, Attributes: 0x9000000000000000

Especially, you'll notice that we are running the same version of Rufus, on the same build of Windows 11, with the same ISO, with the same WUE options, and on a drive that is a similar size.

Yet, my log does report:

Partition 2 (UEFI:NTFS):
  Type: Microsoft Basic Data Partition
  Name: 'UEFI:NTFS'
  Detected File System: FAT12

whereas yours doesn't.

Now, one may still think: "But perhaps this is an issue that only manifests itself when trying to format a drive with a very specific size, and that doesn't manifest itself for other drive sizes" so I also did create a VHD that had the exact same size as the drive you used, and still, despite seeing the exact same values as you get for:

● Creating Main Data Partition (offset: 1048576, size: 14.8 GB)
● Creating UEFI:NTFS Partition (offset: 15937270272, size: 1 MB)

I still ended up with:

Found VHD device 'Microsoft Virtual Disk'
1 device found
Disk type: FIXED, Disk size: 16 GB, Sector size: 512 bytes
Cylinders: 1937, Tracks per cylinder: 255, Sectors per track: 63
Partition type: GPT, NB Partitions: 2
Disk GUID: {C16B4942-FE35-4095-B8BC-A82BF4233FDE}
Max parts: 128, Start Offset: 17408, Usable = 15938320896 bytes
Partition 1:
  Type: Microsoft Basic Data Partition
  Name: 'Main Data Partition'
  Detected File System: NTFS
  ID: {22DF4333-C50C-4638-A947-20F1B5BCE96F}
  Size: 14.8 GB (15936204800 bytes)
  Start Sector: 2048, Attributes: 0x0000000000000000
Partition 2 (UEFI:NTFS):
  Type: Microsoft Basic Data Partition
  Name: 'UEFI:NTFS'
  Detected File System: FAT12
  ID: {A248DC05-AF3C-4D9F-944F-D2274D79A307}
  Size: 1 MB (1064448 bytes)
  Start Sector: 31127481, Attributes: 0x9000000000000000

i.e. with a UEFI:NTFS partition with a file system that was properly recognized.

Therefore your issue has to be environmental.

If I were to take a guess, I'd say you have a security solution on your system, that is interfering with the creation of the UEFI:NTFS partition, and that used to whitelist Rufus 4.4. Weird "Basic feature F used to work with Rufus x.y but not with newer versions" that only YOU seem to be having, usually boil down to security solution whitelisting, and a failure to update the whitelist for newer versions of Rufus.

You may also want to take a look at what actually gets written at offset 15937270272 (or 0x3B5EF7200 in hex) on your media (you can use a utility like HxD to do just that) and see if it matches the binary content we have in https://github.com/pbatard/rufus/blob/master/res/uefi/uefi-ntfs.img, since all Rufus does is copy every byte from uefi-ntfs.img to that location, unmodified.

Especially, you should see something like this: With an explicit UEFI_NTFS and FAT12 set of strings at the right location.

If you don't see that, then, since Rufus did not report an error during the write process, it means that something external to Rufus interfered with the creation of the UEFI:NTFS partition, and you will have to figure out what it is.