RAM EWF on CF hit and miss

I am having a problem getting my EWF to succsessfully install on FBA onto a
CF card.
I am doing the FBA directly on the CF card as I have never been able to get
it to work properly on a HD then transfer it over.
Sometimes after FBA it is fine, sometimes it is not.
The symptoms of when it is not working are as follows:
After FBA, I type in ewfmgr c:
It will then show
Protected volume configuration
Type Ram
State Disabled
Volume ID 25 2d 8a 43 00 73 etc....
and so on.

The clue I know that tells me it is not working is that normally after State
it will show the next Boot command. If it does not show that, it is not
working right.

If I then enable the EWF, I can never disable it.

Where do I look to see what is going wrong?
Any other info needed to help troubleshoot?

More info,
I am partitioning the 512MB CF card using XP and disk management.
I start with a FAT disk (basic , not removable)
I then delete the FAT partition and partition 470MB NTFS partition leaving
about 17MB left over.


"David D" <dditch@plsremov.unitecelectronics.com> wrote in message
news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> I am having a problem getting my EWF to succsessfully install on FBA onto
a
> CF card.
> I am doing the FBA directly on the CF card as I have never been able to
get
> it to work properly on a HD then transfer it over.
> Sometimes after FBA it is fine, sometimes it is not.
> The symptoms of when it is not working are as follows:
> After FBA, I type in ewfmgr c:
> It will then show
> Protected volume configuration
> Type Ram
> State Disabled
> Volume ID 25 2d 8a 43 00 73 etc....
> and so on.
>
> The clue I know that tells me it is not working is that normally after
State
> it will show the next Boot command. If it does not show that, it is not
> working right.
>
> If I then enable the EWF, I can never disable it.
>
> Where do I look to see what is going wrong?
> Any other info needed to help troubleshoot?
>
>

David,

Here's a few suggestions...

1) Follow Slobodan's artcle on www.xpefiles.com for using RAM based EWF
without the need for the small partition.

2) Run FBA on a hard disk. I'm not sure what flash you are using but the
less writes before the device hit's the field the better.

3) You can now use ghost, or whatever utility you like for transferring the
image without worrying about the EWF partition.

4) If you can afford to set "Start EWF disabled" in the runtime and enable
it later after you've made your necessary changes using Ewfmgr, or the EWF
API from your application/shell.

5) Check the FBA log located at windows\fba\fbalog.txt to see what happened
during FBA if the EWF fails.

Link to Slobodan's article...

http://www.xpefiles.com/a_file.cfm?...groupName=Other

HTH,

Brad Combs
Imago Technologies

"David D" <dditch@plsremov.unitecelectronics.com> wrote in message
news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> More info,
> I am partitioning the 512MB CF card using XP and disk management.
> I start with a FAT disk (basic , not removable)
> I then delete the FAT partition and partition 470MB NTFS partition leaving
> about 17MB left over.
>
>
> "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > I am having a problem getting my EWF to succsessfully install on FBA
onto
> a
> > CF card.
> > I am doing the FBA directly on the CF card as I have never been able to
> get
> > it to work properly on a HD then transfer it over.
> > Sometimes after FBA it is fine, sometimes it is not.
> > The symptoms of when it is not working are as follows:
> > After FBA, I type in ewfmgr c:
> > It will then show
> > Protected volume configuration
> > Type Ram
> > State Disabled
> > Volume ID 25 2d 8a 43 00 73 etc....
> > and so on.
> >
> > The clue I know that tells me it is not working is that normally after
> State
> > it will show the next Boot command. If it does not show that, it is not
> > working right.
> >
> > If I then enable the EWF, I can never disable it.
> >
> > Where do I look to see what is going wrong?
> > Any other info needed to help troubleshoot?
> >
> >
>
>

Hi David,
AFAIK as you described your problem your EWF is working.
As Brad mentioned you can use my solution so you can use whole CF space.

Since you have extra partition it is strange that you can't use ewfmgr
C: -disable command.
You should use instead ewfmgr C: -commitanddisable.

BTW:
Why do you create first FAT partition, then delete it and then you create
NTFS?

Create NTFS from the start, and skip this unnecessary steps.

Regards,
Slobodan


"David D" <dditch@plsremov.unitecelectronics.com> wrote in message
news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> More info,
> I am partitioning the 512MB CF card using XP and disk management.
> I start with a FAT disk (basic , not removable)
> I then delete the FAT partition and partition 470MB NTFS partition leaving
> about 17MB left over.
>
>
> "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > I am having a problem getting my EWF to succsessfully install on FBA
onto
> a
> > CF card.
> > I am doing the FBA directly on the CF card as I have never been able to
> get
> > it to work properly on a HD then transfer it over.
> > Sometimes after FBA it is fine, sometimes it is not.
> > The symptoms of when it is not working are as follows:
> > After FBA, I type in ewfmgr c:
> > It will then show
> > Protected volume configuration
> > Type Ram
> > State Disabled
> > Volume ID 25 2d 8a 43 00 73 etc....
> > and so on.
> >
> > The clue I know that tells me it is not working is that normally after
> State
> > it will show the next Boot command. If it does not show that, it is not
> > working right.
> >
> > If I then enable the EWF, I can never disable it.
> >
> > Where do I look to see what is going wrong?
> > Any other info needed to help troubleshoot?
> >
> >
>
>

I"m following Slobodan's guide but maybe I should go back and retrace my
steps.
Everthing used to work but now somehow I have broken something.


"Brad Combs" <brad@imagotechnologies.no.spam.com> wrote in message
news:#pBnH$W9DHA.268@tk2msftngp13.phx.gbl...
> David,
>
> Here's a few suggestions...
>
> 1) Follow Slobodan's artcle on www.xpefiles.com for using RAM based EWF
> without the need for the small partition.
>
> 2) Run FBA on a hard disk. I'm not sure what flash you are using but the
> less writes before the device hit's the field the better.
>
> 3) You can now use ghost, or whatever utility you like for transferring
the
> image without worrying about the EWF partition.
>
> 4) If you can afford to set "Start EWF disabled" in the runtime and enable
> it later after you've made your necessary changes using Ewfmgr, or the EWF
> API from your application/shell.
>
> 5) Check the FBA log located at windows\fba\fbalog.txt to see what
happened
> during FBA if the EWF fails.
>
> Link to Slobodan's article...
>
>
http://www.xpefiles.com/a_file.cfm?...amewf.zip&group
Name=Other
>
> HTH,
>
> Brad Combs
> Imago Technologies
>
> "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> > More info,
> > I am partitioning the 512MB CF card using XP and disk management.
> > I start with a FAT disk (basic , not removable)
> > I then delete the FAT partition and partition 470MB NTFS partition
leaving
> > about 17MB left over.
> >
> >
> > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > > I am having a problem getting my EWF to succsessfully install on FBA
> onto
> > a
> > > CF card.
> > > I am doing the FBA directly on the CF card as I have never been able
to
> > get
> > > it to work properly on a HD then transfer it over.
> > > Sometimes after FBA it is fine, sometimes it is not.
> > > The symptoms of when it is not working are as follows:
> > > After FBA, I type in ewfmgr c:
> > > It will then show
> > > Protected volume configuration
> > > Type Ram
> > > State Disabled
> > > Volume ID 25 2d 8a 43 00 73 etc....
> > > and so on.
> > >
> > > The clue I know that tells me it is not working is that normally after
> > State
> > > it will show the next Boot command. If it does not show that, it is
not
> > > working right.
> > >
> > > If I then enable the EWF, I can never disable it.
> > >
> > > Where do I look to see what is going wrong?
> > > Any other info needed to help troubleshoot?
> > >
> > >
> >
> >
>
>

The CF card comes to me with FAT already formatted.,
I then delete that and create the NTFS partion, make it active using Disk
management on a machine running XP pro.


Right now, I can enable the EWF and it will say enabled after reboot, but
then I can't disable it after that.
Yes, I will use ewfmgr C: -commitanddisable but after reboot, it still comes
back up to be enabled.

"Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
news:#FGA6ZX9DHA.2480@TK2MSFTNGP10.phx.gbl...
> Hi David,
> AFAIK as you described your problem your EWF is working.
> As Brad mentioned you can use my solution so you can use whole CF space.
>
> Since you have extra partition it is strange that you can't use ewfmgr
> C: -disable command.
> You should use instead ewfmgr C: -commitanddisable.
>
> BTW:
> Why do you create first FAT partition, then delete it and then you create
> NTFS?
>
> Create NTFS from the start, and skip this unnecessary steps.
>
> Regards,
> Slobodan
>
>
> "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> > More info,
> > I am partitioning the 512MB CF card using XP and disk management.
> > I start with a FAT disk (basic , not removable)
> > I then delete the FAT partition and partition 470MB NTFS partition
leaving
> > about 17MB left over.
> >
> >
> > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > > I am having a problem getting my EWF to succsessfully install on FBA
> onto
> > a
> > > CF card.
> > > I am doing the FBA directly on the CF card as I have never been able
to
> > get
> > > it to work properly on a HD then transfer it over.
> > > Sometimes after FBA it is fine, sometimes it is not.
> > > The symptoms of when it is not working are as follows:
> > > After FBA, I type in ewfmgr c:
> > > It will then show
> > > Protected volume configuration
> > > Type Ram
> > > State Disabled
> > > Volume ID 25 2d 8a 43 00 73 etc....
> > > and so on.
> > >
> > > The clue I know that tells me it is not working is that normally after
> > State
> > > it will show the next Boot command. If it does not show that, it is
not
> > > working right.
> > >
> > > If I then enable the EWF, I can never disable it.
> > >
> > > Where do I look to see what is going wrong?
> > > Any other info needed to help troubleshoot?
> > >
> > >
> >
> >
>
>

If you are using my approach then only one value in registry will tell EWF
that it should be enabled or disabled during the boot.

If commit option is working then commitanddisable must work. If
commitanddisable is not wokring you always have an option to change value in
registry to disabled and then to commit EWF changes.

This way EWF will be disabled. But since you are first to report this
problem, then you should tell us what EWF QFE you are using.

Regards,
Slobodan


"David D" <dditch@plsremov.unitecelectronics.com> wrote in message
news:O6fPuwY9DHA.1632@TK2MSFTNGP12.phx.gbl...
> The CF card comes to me with FAT already formatted.,
> I then delete that and create the NTFS partion, make it active using Disk
> management on a machine running XP pro.
>
>
> Right now, I can enable the EWF and it will say enabled after reboot, but
> then I can't disable it after that.
> Yes, I will use ewfmgr C: -commitanddisable but after reboot, it still
comes
> back up to be enabled.
>
> "Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
> news:#FGA6ZX9DHA.2480@TK2MSFTNGP10.phx.gbl...
> > Hi David,
> > AFAIK as you described your problem your EWF is working.
> > As Brad mentioned you can use my solution so you can use whole CF space.
> >
> > Since you have extra partition it is strange that you can't use ewfmgr
> > C: -disable command.
> > You should use instead ewfmgr C: -commitanddisable.
> >
> > BTW:
> > Why do you create first FAT partition, then delete it and then you
create
> > NTFS?
> >
> > Create NTFS from the start, and skip this unnecessary steps.
> >
> > Regards,
> > Slobodan
> >
> >
> > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> > > More info,
> > > I am partitioning the 512MB CF card using XP and disk management.
> > > I start with a FAT disk (basic , not removable)
> > > I then delete the FAT partition and partition 470MB NTFS partition
> leaving
> > > about 17MB left over.
> > >
> > >
> > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > > > I am having a problem getting my EWF to succsessfully install on FBA
> > onto
> > > a
> > > > CF card.
> > > > I am doing the FBA directly on the CF card as I have never been able
> to
> > > get
> > > > it to work properly on a HD then transfer it over.
> > > > Sometimes after FBA it is fine, sometimes it is not.
> > > > The symptoms of when it is not working are as follows:
> > > > After FBA, I type in ewfmgr c:
> > > > It will then show
> > > > Protected volume configuration
> > > > Type Ram
> > > > State Disabled
> > > > Volume ID 25 2d 8a 43 00 73 etc....
> > > > and so on.
> > > >
> > > > The clue I know that tells me it is not working is that normally
after
> > > State
> > > > it will show the next Boot command. If it does not show that, it is
> not
> > > > working right.
> > > >
> > > > If I then enable the EWF, I can never disable it.
> > > >
> > > > Where do I look to see what is going wrong?
> > > > Any other info needed to help troubleshoot?
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Maybe I have done something wrong in the setup:
Here is what I have in TD:

components added:
Enable Auto LAyout setting 1.1 R5
It looks like i may have added the following into the component but is
currently disabled:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed\Volume0]

"VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"

"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"

"Enabled"=dword:00000000

"Type"=dword:00000001



Enhanced Write Filter - Hotfix Q823025 Version 2.0.1901.2 R1901

Settings are described in Slobodan's guide

ewfdll.dll and ewfinit.dll are disabled

FBA DLL/Com registration is disabled

EWF manager console application Version 5.1.2600.1106 R1507

EWF NTLDR Version 5.1.2600.1106 R1507

EWF Ram Registery based on Hotfix Q23025



Up at the top in Extra registry settings for the project I have the
following:


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed\Volume0]

"VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"

"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"

"Enabled"=dword:00000000

"Type"=dword:00000001





Looking at my XPe image, IN the registry I have:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed\Volume0]

[ab] (Default) Reg_SZ (Value not set)

[ab] ArcName REG_SZ multi(0)disk(0)rdisk(0)partition(1)

[011110] Enabled REG_DWORD (0)

[011110] Type REG_DWORD (1)

[ab] VolumeID {1EA414D1-6760-4625-8CBE-4F9F85A48E15}



Maybe a little better understanding on how the EWF works will help me.

How does XPe know that the EWF is disabled on the next boot? If there is no
extra partition to keep this info, where does XP store this info on the CF
and how with this method?



David







"Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
news:OyG745Y9DHA.2644@TK2MSFTNGP11.phx.gbl...
> If you are using my approach then only one value in registry will tell EWF
> that it should be enabled or disabled during the boot.
>
> If commit option is working then commitanddisable must work. If
> commitanddisable is not wokring you always have an option to change value
in
> registry to disabled and then to commit EWF changes.
>
> This way EWF will be disabled. But since you are first to report this
> problem, then you should tell us what EWF QFE you are using.
>
> Regards,
> Slobodan
>
>
> "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> news:O6fPuwY9DHA.1632@TK2MSFTNGP12.phx.gbl...
> > The CF card comes to me with FAT already formatted.,
> > I then delete that and create the NTFS partion, make it active using
Disk
> > management on a machine running XP pro.
> >
> >
> > Right now, I can enable the EWF and it will say enabled after reboot,
but
> > then I can't disable it after that.
> > Yes, I will use ewfmgr C: -commitanddisable but after reboot, it still
> comes
> > back up to be enabled.
> >
> > "Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
> > news:#FGA6ZX9DHA.2480@TK2MSFTNGP10.phx.gbl...
> > > Hi David,
> > > AFAIK as you described your problem your EWF is working.
> > > As Brad mentioned you can use my solution so you can use whole CF
space.
> > >
> > > Since you have extra partition it is strange that you can't use ewfmgr
> > > C: -disable command.
> > > You should use instead ewfmgr C: -commitanddisable.
> > >
> > > BTW:
> > > Why do you create first FAT partition, then delete it and then you
> create
> > > NTFS?
> > >
> > > Create NTFS from the start, and skip this unnecessary steps.
> > >
> > > Regards,
> > > Slobodan
> > >
> > >
> > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> > > > More info,
> > > > I am partitioning the 512MB CF card using XP and disk management.
> > > > I start with a FAT disk (basic , not removable)
> > > > I then delete the FAT partition and partition 470MB NTFS partition
> > leaving
> > > > about 17MB left over.
> > > >
> > > >
> > > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > > news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > > > > I am having a problem getting my EWF to succsessfully install on
FBA
> > > onto
> > > > a
> > > > > CF card.
> > > > > I am doing the FBA directly on the CF card as I have never been
able
> > to
> > > > get
> > > > > it to work properly on a HD then transfer it over.
> > > > > Sometimes after FBA it is fine, sometimes it is not.
> > > > > The symptoms of when it is not working are as follows:
> > > > > After FBA, I type in ewfmgr c:
> > > > > It will then show
> > > > > Protected volume configuration
> > > > > Type Ram
> > > > > State Disabled
> > > > > Volume ID 25 2d 8a 43 00 73 etc....
> > > > > and so on.
> > > > >
> > > > > The clue I know that tells me it is not working is that normally
> after
> > > > State
> > > > > it will show the next Boot command. If it does not show that, it
is
> > not
> > > > > working right.
> > > > >
> > > > > If I then enable the EWF, I can never disable it.
> > > > >
> > > > > Where do I look to see what is going wrong?
> > > > > Any other info needed to help troubleshoot?
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protecte
d\Volume0\Enabled

0 - Disabled
1 - Enabled

Regards,
Slobodan

"David D" <dditch@plsremov.unitecelectronics.com> wrote in message
news:ewgNYCa9DHA.2412@TK2MSFTNGP09.phx.gbl...
> Maybe I have done something wrong in the setup:
> Here is what I have in TD:
>
> components added:
> Enable Auto LAyout setting 1.1 R5
> It looks like i may have added the following into the component but is
> currently disabled:
>
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]
>
>
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> ed]
>
>
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> ed\Volume0]
>
> "VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
>
> "ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
>
> "Enabled"=dword:00000000
>
> "Type"=dword:00000001
>
>
>
> Enhanced Write Filter - Hotfix Q823025 Version 2.0.1901.2 R1901
>
> Settings are described in Slobodan's guide
>
> ewfdll.dll and ewfinit.dll are disabled
>
> FBA DLL/Com registration is disabled
>
> EWF manager console application Version 5.1.2600.1106 R1507
>
> EWF NTLDR Version 5.1.2600.1106 R1507
>
> EWF Ram Registery based on Hotfix Q23025
>
>
>
> Up at the top in Extra registry settings for the project I have the
> following:
>
>
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]
>
>
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> ed]
>
>
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> ed\Volume0]
>
> "VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
>
> "ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
>
> "Enabled"=dword:00000000
>
> "Type"=dword:00000001
>
>
>
>
>
> Looking at my XPe image, IN the registry I have:
>
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> ed\Volume0]
>
> [ab] (Default) Reg_SZ (Value not set)
>
> [ab] ArcName REG_SZ multi(0)disk(0)rdisk(0)partition(1)
>
> [011110] Enabled REG_DWORD (0)
>
> [011110] Type REG_DWORD (1)
>
> [ab] VolumeID {1EA414D1-6760-4625-8CBE-4F9F85A48E15}
>
>
>
> Maybe a little better understanding on how the EWF works will help me.
>
> How does XPe know that the EWF is disabled on the next boot? If there is
no
> extra partition to keep this info, where does XP store this info on the CF
> and how with this method?
>
>
>
> David
>
>
>
>
>
>
>
> "Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
> news:OyG745Y9DHA.2644@TK2MSFTNGP11.phx.gbl...
> > If you are using my approach then only one value in registry will tell
EWF
> > that it should be enabled or disabled during the boot.
> >
> > If commit option is working then commitanddisable must work. If
> > commitanddisable is not wokring you always have an option to change
value
> in
> > registry to disabled and then to commit EWF changes.
> >
> > This way EWF will be disabled. But since you are first to report this
> > problem, then you should tell us what EWF QFE you are using.
> >
> > Regards,
> > Slobodan
> >
> >
> > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > news:O6fPuwY9DHA.1632@TK2MSFTNGP12.phx.gbl...
> > > The CF card comes to me with FAT already formatted.,
> > > I then delete that and create the NTFS partion, make it active using
> Disk
> > > management on a machine running XP pro.
> > >
> > >
> > > Right now, I can enable the EWF and it will say enabled after reboot,
> but
> > > then I can't disable it after that.
> > > Yes, I will use ewfmgr C: -commitanddisable but after reboot, it still
> > comes
> > > back up to be enabled.
> > >
> > > "Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
> > > news:#FGA6ZX9DHA.2480@TK2MSFTNGP10.phx.gbl...
> > > > Hi David,
> > > > AFAIK as you described your problem your EWF is working.
> > > > As Brad mentioned you can use my solution so you can use whole CF
> space.
> > > >
> > > > Since you have extra partition it is strange that you can't use
ewfmgr
> > > > C: -disable command.
> > > > You should use instead ewfmgr C: -commitanddisable.
> > > >
> > > > BTW:
> > > > Why do you create first FAT partition, then delete it and then you
> > create
> > > > NTFS?
> > > >
> > > > Create NTFS from the start, and skip this unnecessary steps.
> > > >
> > > > Regards,
> > > > Slobodan
> > > >
> > > >
> > > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > > news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> > > > > More info,
> > > > > I am partitioning the 512MB CF card using XP and disk management.
> > > > > I start with a FAT disk (basic , not removable)
> > > > > I then delete the FAT partition and partition 470MB NTFS partition
> > > leaving
> > > > > about 17MB left over.
> > > > >
> > > > >
> > > > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > > > news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > > > > > I am having a problem getting my EWF to succsessfully install on
> FBA
> > > > onto
> > > > > a
> > > > > > CF card.
> > > > > > I am doing the FBA directly on the CF card as I have never been
> able
> > > to
> > > > > get
> > > > > > it to work properly on a HD then transfer it over.
> > > > > > Sometimes after FBA it is fine, sometimes it is not.
> > > > > > The symptoms of when it is not working are as follows:
> > > > > > After FBA, I type in ewfmgr c:
> > > > > > It will then show
> > > > > > Protected volume configuration
> > > > > > Type Ram
> > > > > > State Disabled
> > > > > > Volume ID 25 2d 8a 43 00 73 etc....
> > > > > > and so on.
> > > > > >
> > > > > > The clue I know that tells me it is not working is that normally
> > after
> > > > > State
> > > > > > it will show the next Boot command. If it does not show that, it
> is
> > > not
> > > > > > working right.
> > > > > >
> > > > > > If I then enable the EWF, I can never disable it.
> > > > > >
> > > > > > Where do I look to see what is going wrong?
> > > > > > Any other info needed to help troubleshoot?
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Thats in the registry and I can use regedit to change it, but rebooting
still leaves it enabled.
If the Registry is in ram because the EWF is enabled, how does it get to the
CF card version of the file?

Are my settings and components correct?

David
"Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
news:e5P7CSa9DHA.488@TK2MSFTNGP12.phx.gbl...
>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protecte
> d\Volume0\Enabled
>
> 0 - Disabled
> 1 - Enabled
>
> Regards,
> Slobodan
>
> "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> news:ewgNYCa9DHA.2412@TK2MSFTNGP09.phx.gbl...
> > Maybe I have done something wrong in the setup:
> > Here is what I have in TD:
> >
> > components added:
> > Enable Auto LAyout setting 1.1 R5
> > It looks like i may have added the following into the component but
is
> > currently disabled:
> >
> > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]
> >
> >
> >
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> > ed]
> >
> >
> >
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> > ed\Volume0]
> >
> > "VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
> >
> > "ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
> >
> > "Enabled"=dword:00000000
> >
> > "Type"=dword:00000001
> >
> >
> >
> > Enhanced Write Filter - Hotfix Q823025 Version 2.0.1901.2 R1901
> >
> > Settings are described in Slobodan's guide
> >
> > ewfdll.dll and ewfinit.dll are disabled
> >
> > FBA DLL/Com registration is disabled
> >
> > EWF manager console application Version 5.1.2600.1106 R1507
> >
> > EWF NTLDR Version 5.1.2600.1106 R1507
> >
> > EWF Ram Registery based on Hotfix Q23025
> >
> >
> >
> > Up at the top in Extra registry settings for the project I have the
> > following:
> >
> >
> > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]
> >
> >
> >
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> > ed]
> >
> >
> >
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> > ed\Volume0]
> >
> > "VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
> >
> > "ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
> >
> > "Enabled"=dword:00000000
> >
> > "Type"=dword:00000001
> >
> >
> >
> >
> >
> > Looking at my XPe image, IN the registry I have:
> >
> >
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
> > ed\Volume0]
> >
> > [ab] (Default) Reg_SZ (Value not set)
> >
> > [ab] ArcName REG_SZ multi(0)disk(0)rdisk(0)partition(1)
> >
> > [011110] Enabled REG_DWORD (0)
> >
> > [011110] Type REG_DWORD (1)
> >
> > [ab] VolumeID {1EA414D1-6760-4625-8CBE-4F9F85A48E15}
> >
> >
> >
> > Maybe a little better understanding on how the EWF works will help me.
> >
> > How does XPe know that the EWF is disabled on the next boot? If there is
> no
> > extra partition to keep this info, where does XP store this info on the
CF
> > and how with this method?
> >
> >
> >
> > David
> >
> >
> >
> >
> >
> >
> >
> > "Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
> > news:OyG745Y9DHA.2644@TK2MSFTNGP11.phx.gbl...
> > > If you are using my approach then only one value in registry will tell
> EWF
> > > that it should be enabled or disabled during the boot.
> > >
> > > If commit option is working then commitanddisable must work. If
> > > commitanddisable is not wokring you always have an option to change
> value
> > in
> > > registry to disabled and then to commit EWF changes.
> > >
> > > This way EWF will be disabled. But since you are first to report this
> > > problem, then you should tell us what EWF QFE you are using.
> > >
> > > Regards,
> > > Slobodan
> > >
> > >
> > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > news:O6fPuwY9DHA.1632@TK2MSFTNGP12.phx.gbl...
> > > > The CF card comes to me with FAT already formatted.,
> > > > I then delete that and create the NTFS partion, make it active using
> > Disk
> > > > management on a machine running XP pro.
> > > >
> > > >
> > > > Right now, I can enable the EWF and it will say enabled after
reboot,
> > but
> > > > then I can't disable it after that.
> > > > Yes, I will use ewfmgr C: -commitanddisable but after reboot, it
still
> > > comes
> > > > back up to be enabled.
> > > >
> > > > "Slobodan Brcin (eMVP)" <sbrcin@ptt.yu> wrote in message
> > > > news:#FGA6ZX9DHA.2480@TK2MSFTNGP10.phx.gbl...
> > > > > Hi David,
> > > > > AFAIK as you described your problem your EWF is working.
> > > > > As Brad mentioned you can use my solution so you can use whole CF
> > space.
> > > > >
> > > > > Since you have extra partition it is strange that you can't use
> ewfmgr
> > > > > C: -disable command.
> > > > > You should use instead ewfmgr C: -commitanddisable.
> > > > >
> > > > > BTW:
> > > > > Why do you create first FAT partition, then delete it and then you
> > > create
> > > > > NTFS?
> > > > >
> > > > > Create NTFS from the start, and skip this unnecessary steps.
> > > > >
> > > > > Regards,
> > > > > Slobodan
> > > > >
> > > > >
> > > > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in message
> > > > > news:ehYIyaW9DHA.2404@TK2MSFTNGP11.phx.gbl...
> > > > > > More info,
> > > > > > I am partitioning the 512MB CF card using XP and disk
management.
> > > > > > I start with a FAT disk (basic , not removable)
> > > > > > I then delete the FAT partition and partition 470MB NTFS
partition
> > > > leaving
> > > > > > about 17MB left over.
> > > > > >
> > > > > >
> > > > > > "David D" <dditch@plsremov.unitecelectronics.com> wrote in
message
> > > > > > news:u4cQX5V9DHA.2064@TK2MSFTNGP11.phx.gbl...
> > > > > > > I am having a problem getting my EWF to succsessfully install
on
> > FBA
> > > > > onto
> > > > > > a
> > > > > > > CF card.
> > > > > > > I am doing the FBA directly on the CF card as I have never
been
> > able
> > > > to
> > > > > > get
> > > > > > > it to work properly on a HD then transfer it over.
> > > > > > > Sometimes after FBA it is fine, sometimes it is not.
> > > > > > > The symptoms of when it is not working are as follows:
> > > > > > > After FBA, I type in ewfmgr c:
> > > > > > > It will then show
> > > > > > > Protected volume configuration
> > > > > > > Type Ram
> > > > > > > State Disabled
> > > > > > > Volume ID 25 2d 8a 43 00 73 etc....
> > > > > > > and so on.
> > > > > > >
> > > > > > > The clue I know that tells me it is not working is that
normally
> > > after
> > > > > > State
> > > > > > > it will show the next Boot command. If it does not show that,
it
> > is
> > > > not
> > > > > > > working right.
> > > > > > >
> > > > > > > If I then enable the EWF, I can never disable it.
> > > > > > >
> > > > > > > Where do I look to see what is going wrong?
> > > > > > > Any other info needed to help troubleshoot?
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>