EWF problem

G

Guest

I'm sure this is just a configuration problem.

My target platform has an IDE Hard Disk configured into two partitions. One
with XP Pro(C:), the other is the intermediary partition for XPe(D:). Also I
have a 512MB CF card(E:) formatted as FAT32.


I have followed the following:

http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

except:
Disk Number field is set to 1.
ArcName( multi(0)disk(1)rdisk(0)partition(1) )

When I run ewfmgr C:, D:, or E:, I get the following error:
Failed getting protected volume configuration with error 1
Incorrect function

Any help would be appreciated.
 
G

Guest

Thanks for the info.
I added the addtional key to the registry and I still get the error.
Also ewfmgr.exe is not part of my XPe image. I have bring it over.

I have also tried to boot from my Compact flash card.
From XP Pro, I ran Disk Manager, formatted it as a FAT32, made it active.

I booted from a DOS disk and ran bootprep. bootprep gave me an error, not
sure what it was.
I tried Slobodan's boot.ini file to test the disks geometry, it came up with
"Disk Error".

At this point I'm at a loss as what to try next.
 
K

KM

Can you show us your FBAlog.txt?
Also, please export EWF service registry entries and post them here.

That should help us narrow down the issue.
 
G

Guest

FBAlog.txt
Which section would be useful?
It's too long to post here.

EWF Services Registry Settings:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"CompareBeforeAlloc"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
 
K

KM

W Schmoegner,

You can actually use news client like Outlook Express and then you will be able to attach files.

Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
The concern is that you shouldn't have EWF enabled in preFBA image.
(I can't see [HKEY_LOCAL_MACHINE\CurrentControlSet\Services\EWF\FBA] branch)

Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)

What the output of the ewfmgr tool?

--
=========
Regards,
KM

FBAlog.txt
Which section would be useful?
It's too long to post here.

EWF Services Registry Settings:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"CompareBeforeAlloc"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001



KM said:
Can you show us your FBAlog.txt?
Also, please export EWF service registry entries and post them here.

That should help us narrow down the issue.
 
G

Guest

Unfortunately the systems I have at my disposal that have internet
connections is locked down very tightly.
I don't have Outlook Express or any news clients. Just web browsers.
Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
Post FBA.
Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)
OK, do I change the disk() or rdisk() parameter to '1'?

I guess my problem with booting from CF is that it is marked removable. I'll
have to order the
fixed versions.
What the output of the ewfmgr tool?
ewfmgr C:
Protected Volume Configuration
Type RAM (REG)
State ENABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID E9 68 E9 68 00 7E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level 1

Memory used for data 806912 bytes
Memory used for mapping 4096 bytes

ewfmgr D:
Failed getting protected volume configuration with error 1.
Incorrect function.

ewfmgr E:
Failed getting protected volume configuration with error 1.
Incorrect function.



KM said:
W Schmoegner,

You can actually use news client like Outlook Express and then you will be able to attach files.

Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
The concern is that you shouldn't have EWF enabled in preFBA image.
(I can't see [HKEY_LOCAL_MACHINE\CurrentControlSet\Services\EWF\FBA] branch)

Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)

What the output of the ewfmgr tool?

--
=========
Regards,
KM

FBAlog.txt
Which section would be useful?
It's too long to post here.

EWF Services Registry Settings:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"CompareBeforeAlloc"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001



KM said:
Can you show us your FBAlog.txt?
Also, please export EWF service registry entries and post them here.

That should help us narrow down the issue.

--
=========
Regards,
KM

Thanks for the info.
I added the addtional key to the registry and I still get the error.
Also ewfmgr.exe is not part of my XPe image. I have bring it over.

I have also tried to boot from my Compact flash card.
From XP Pro, I ran Disk Manager, formatted it as a FAT32, made it active.

I booted from a DOS disk and ran bootprep. bootprep gave me an error, not
sure what it was.
I tried Slobodan's boot.ini file to test the disks geometry, it came up with
"Disk Error".

At this point I'm at a loss as what to try next.

:

Please read this thread:
http://groups.google.com/group/micr...4d2c6c9f0a0/30226c3f8d1db4a7#30226c3f8d1db4a7


--
=========
Regards,
KM


I'm sure this is just a configuration problem.

My target platform has an IDE Hard Disk configured into two partitions. One
with XP Pro(C:), the other is the intermediary partition for XPe(D:). Also I
have a 512MB CF card(E:) formatted as FAT32.


I have followed the following:

http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

except:
Disk Number field is set to 1.
ArcName( multi(0)disk(1)rdisk(0)partition(1) )

When I run ewfmgr C:, D:, or E:, I get the following error:
Failed getting protected volume configuration with error 1
Incorrect function

Any help would be appreciated.
 
K

KM

W Schmoegner,

What exactly you're trying to fix? I mean what drive you want to protect?

Right now you C: drive is protected. (first partition)

The errors you are seeing from ewfmgr for other drives are expected (since you are using EWF RAM REG mode).

--
=========
Regards,
KM
Unfortunately the systems I have at my disposal that have internet
connections is locked down very tightly.
I don't have Outlook Express or any news clients. Just web browsers.
Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
Post FBA.
Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)
OK, do I change the disk() or rdisk() parameter to '1'?

I guess my problem with booting from CF is that it is marked removable. I'll
have to order the
fixed versions.
What the output of the ewfmgr tool?
ewfmgr C:
Protected Volume Configuration
Type RAM (REG)
State ENABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID E9 68 E9 68 00 7E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level 1

Memory used for data 806912 bytes
Memory used for mapping 4096 bytes

ewfmgr D:
Failed getting protected volume configuration with error 1.
Incorrect function.

ewfmgr E:
Failed getting protected volume configuration with error 1.
Incorrect function.



KM said:
W Schmoegner,

You can actually use news client like Outlook Express and then you will be able to attach files.

Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
The concern is that you shouldn't have EWF enabled in preFBA image.
(I can't see [HKEY_LOCAL_MACHINE\CurrentControlSet\Services\EWF\FBA] branch)

Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)

What the output of the ewfmgr tool?

--
=========
Regards,
KM

FBAlog.txt
Which section would be useful?
It's too long to post here.

EWF Services Registry Settings:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"CompareBeforeAlloc"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001



:


Can you show us your FBAlog.txt?
Also, please export EWF service registry entries and post them here.

That should help us narrow down the issue.

--
=========
Regards,
KM

Thanks for the info.
I added the addtional key to the registry and I still get the error.
Also ewfmgr.exe is not part of my XPe image. I have bring it over.

I have also tried to boot from my Compact flash card.
From XP Pro, I ran Disk Manager, formatted it as a FAT32, made it active.

I booted from a DOS disk and ran bootprep. bootprep gave me an error, not
sure what it was.
I tried Slobodan's boot.ini file to test the disks geometry, it came up with
"Disk Error".

At this point I'm at a loss as what to try next.

:

Please read this thread:
http://groups.google.com/group/micr...4d2c6c9f0a0/30226c3f8d1db4a7#30226c3f8d1db4a7


--
=========
Regards,
KM


I'm sure this is just a configuration problem.

My target platform has an IDE Hard Disk configured into two partitions. One
with XP Pro(C:), the other is the intermediary partition for XPe(D:). Also I
have a 512MB CF card(E:) formatted as FAT32.


I have followed the following:

http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

except:
Disk Number field is set to 1.
ArcName( multi(0)disk(1)rdisk(0)partition(1) )

When I run ewfmgr C:, D:, or E:, I get the following error:
Failed getting protected volume configuration with error 1
Incorrect function

Any help would be appreciated.
 
G

Guest

Basically the CF drive.
When I set the BIOS to boot from it, it becomes the C: drive.
Do I leave this image protecting the C: drive?
Because my target system won't have a Hard Disk.

KM said:
W Schmoegner,

What exactly you're trying to fix? I mean what drive you want to protect?

Right now you C: drive is protected. (first partition)

The errors you are seeing from ewfmgr for other drives are expected (since you are using EWF RAM REG mode).

--
=========
Regards,
KM
Unfortunately the systems I have at my disposal that have internet
connections is locked down very tightly.
I don't have Outlook Express or any news clients. Just web browsers.
Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
Post FBA.
Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)
OK, do I change the disk() or rdisk() parameter to '1'?

I guess my problem with booting from CF is that it is marked removable. I'll
have to order the
fixed versions.
What the output of the ewfmgr tool?
ewfmgr C:
Protected Volume Configuration
Type RAM (REG)
State ENABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID E9 68 E9 68 00 7E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level 1

Memory used for data 806912 bytes
Memory used for mapping 4096 bytes

ewfmgr D:
Failed getting protected volume configuration with error 1.
Incorrect function.

ewfmgr E:
Failed getting protected volume configuration with error 1.
Incorrect function.



KM said:
W Schmoegner,

You can actually use news client like Outlook Express and then you will be able to attach files.

Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
The concern is that you shouldn't have EWF enabled in preFBA image.
(I can't see [HKEY_LOCAL_MACHINE\CurrentControlSet\Services\EWF\FBA] branch)

Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)

What the output of the ewfmgr tool?

--
=========
Regards,
KM


FBAlog.txt
Which section would be useful?
It's too long to post here.

EWF Services Registry Settings:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"CompareBeforeAlloc"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001



:


Can you show us your FBAlog.txt?
Also, please export EWF service registry entries and post them here.

That should help us narrow down the issue.

--
=========
Regards,
KM

Thanks for the info.
I added the addtional key to the registry and I still get the error.
Also ewfmgr.exe is not part of my XPe image. I have bring it over.

I have also tried to boot from my Compact flash card.
From XP Pro, I ran Disk Manager, formatted it as a FAT32, made it active.

I booted from a DOS disk and ran bootprep. bootprep gave me an error, not
sure what it was.
I tried Slobodan's boot.ini file to test the disks geometry, it came up with
"Disk Error".

At this point I'm at a loss as what to try next.

:

Please read this thread:
http://groups.google.com/group/micr...4d2c6c9f0a0/30226c3f8d1db4a7#30226c3f8d1db4a7


--
=========
Regards,
KM


I'm sure this is just a configuration problem.

My target platform has an IDE Hard Disk configured into two partitions. One
with XP Pro(C:), the other is the intermediary partition for XPe(D:). Also I
have a 512MB CF card(E:) formatted as FAT32.


I have followed the following:

http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

except:
Disk Number field is set to 1.
ArcName( multi(0)disk(1)rdisk(0)partition(1) )

When I run ewfmgr C:, D:, or E:, I get the following error:
Failed getting protected volume configuration with error 1
Incorrect function

Any help would be appreciated.
 
K

KM

W Schmoegner,

EWF will protect a partition by ARC path, not drive letter.
Just make sure to match the Arc path from boot.ini when you switch to boot from CF to the Arc path in EWF registry branch.

--
=========
Regards,
KM
Basically the CF drive.
When I set the BIOS to boot from it, it becomes the C: drive.
Do I leave this image protecting the C: drive?
Because my target system won't have a Hard Disk.

KM said:
W Schmoegner,

What exactly you're trying to fix? I mean what drive you want to protect?

Right now you C: drive is protected. (first partition)

The errors you are seeing from ewfmgr for other drives are expected (since you are using EWF RAM REG mode).

--
=========
Regards,
KM
Unfortunately the systems I have at my disposal that have internet
connections is locked down very tightly.
I don't have Outlook Express or any news clients. Just web browsers.

Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
Post FBA.

Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)
OK, do I change the disk() or rdisk() parameter to '1'?

I guess my problem with booting from CF is that it is marked removable. I'll
have to order the
fixed versions.

What the output of the ewfmgr tool?
ewfmgr C:
Protected Volume Configuration
Type RAM (REG)
State ENABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID E9 68 E9 68 00 7E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level 1

Memory used for data 806912 bytes
Memory used for mapping 4096 bytes

ewfmgr D:
Failed getting protected volume configuration with error 1.
Incorrect function.

ewfmgr E:
Failed getting protected volume configuration with error 1.
Incorrect function.



:

W Schmoegner,

You can actually use news client like Outlook Express and then you will be able to attach files.

Are the registry settings you showed below grabbed from post FBA? Or are those from pre FBA image?
The concern is that you shouldn't have EWF enabled in preFBA image.
(I can't see [HKEY_LOCAL_MACHINE\CurrentControlSet\Services\EWF\FBA] branch)

Also, doesn't seem that the ArcPath for EWF protected volume matches what you mentioned earlier (Disk=1)

What the output of the ewfmgr tool?

--
=========
Regards,
KM


FBAlog.txt
Which section would be useful?
It's too long to post here.

EWF Services Registry Settings:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"CompareBeforeAlloc"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001



:


Can you show us your FBAlog.txt?
Also, please export EWF service registry entries and post them here.

That should help us narrow down the issue.

--
=========
Regards,
KM

Thanks for the info.
I added the addtional key to the registry and I still get the error.
Also ewfmgr.exe is not part of my XPe image. I have bring it over.

I have also tried to boot from my Compact flash card.
From XP Pro, I ran Disk Manager, formatted it as a FAT32, made it active.

I booted from a DOS disk and ran bootprep. bootprep gave me an error, not
sure what it was.
I tried Slobodan's boot.ini file to test the disks geometry, it came up with
"Disk Error".

At this point I'm at a loss as what to try next.

:

Please read this thread:
http://groups.google.com/group/micr...4d2c6c9f0a0/30226c3f8d1db4a7#30226c3f8d1db4a7


--
=========
Regards,
KM


I'm sure this is just a configuration problem.

My target platform has an IDE Hard Disk configured into two partitions. One
with XP Pro(C:), the other is the intermediary partition for XPe(D:). Also I
have a 512MB CF card(E:) formatted as FAT32.


I have followed the following:

http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

except:
Disk Number field is set to 1.
ArcName( multi(0)disk(1)rdisk(0)partition(1) )

When I run ewfmgr C:, D:, or E:, I get the following error:
Failed getting protected volume configuration with error 1
Incorrect function

Any help would be appreciated.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top