ewf ram reg mode with "unable to find an ewf volume"

G

Guest

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in the
fbalog.txt and verified the registry entries are all there. But after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable to find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
 
K

KM

Benjamin,

Did you have the Type value set up under [HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the [HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image you should have Enabled=dword:0.
 
M

Matt Kellner \(MS\)

Benjamin, there is a typo in the MSDN article on configuring RAM REG mode
that has been causing some problems. I submitted a request to have this
updated several months ago - I apologize that it still has not been updated.

The typo is in Step 8. The second registry key is listed as:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.

Note that there is a period at the end of this key. This is a typo, as most
people will likely copy that period into the registry, resulting in an
incorrect key. If you copy/paste the string into your registry settings, be
sure to remove the period at the end of the reg key - this should resolve
your problem if you followed the rest of the instructions correctly.

Hope this helps. =)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================
 
G

Guest

KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


KM said:
Benjamin,

Did you have the Type value set up under [HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the [HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image you should have Enabled=dword:0.
Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in the
fbalog.txt and verified the registry entries are all there. But after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable to find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
 
M

Matt Kellner \(MS\)

Benjamin, see my reply to your original message in this thread - I believe
the problem is likely to be in a slightly different branch of the registry,
due to a typo on the MSDN page. (This typo was corrected over the weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================

Benjamin said:
KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


KM said:
Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image you
should have Enabled=dword:0.
Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in the
fbalog.txt and verified the registry entries are all there. But after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 
G

Guest

Matt Kellner,

I checked again, but the name of the registry key is correct without the
period as you mentioned. Do you have any idea? Thanks.

B. Rgds,
Benjamin

Matt Kellner (MS) said:
Benjamin, see my reply to your original message in this thread - I believe
the problem is likely to be in a slightly different branch of the registry,
due to a typo on the MSDN page. (This typo was corrected over the weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================

Benjamin said:
KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


KM said:
Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image you
should have Enabled=dword:0.

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in the
fbalog.txt and verified the registry entries are all there. But after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 
F

Franz Leu

Benjamin

Also make sure you use either:
- ewfmgr c: (where c is your drive - you always have to add the drive) or
- ewfmgr -all
It will give an error otherwise.

Franz


Benjamin said:
Matt Kellner,

I checked again, but the name of the registry key is correct without the
period as you mentioned. Do you have any idea? Thanks.

B. Rgds,
Benjamin

Matt Kellner (MS) said:
Benjamin, see my reply to your original message in this thread - I
believe
the problem is likely to be in a slightly different branch of the
registry,
due to a typo on the MSDN page. (This typo was corrected over the
weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no
rights.
===============================

Benjamin said:
KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


:

Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image
you
should have Enabled=dword:0.

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in
the
fbalog.txt and verified the registry entries are all there. But
after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable
to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 
S

Slobodan Brcin \(eMVP\)

Franz,

You might want to try component:
http://www.slobodanbrcin.com/xpe/ewf/regramewf.html

You won't need to configure anything just put it in your project it will configure EWF automaticaly.

Regards,
Slobodan

Franz Leu said:
Benjamin

Also make sure you use either:
- ewfmgr c: (where c is your drive - you always have to add the drive) or
- ewfmgr -all
It will give an error otherwise.

Franz


Benjamin said:
Matt Kellner,

I checked again, but the name of the registry key is correct without the
period as you mentioned. Do you have any idea? Thanks.

B. Rgds,
Benjamin

Matt Kellner (MS) said:
Benjamin, see my reply to your original message in this thread - I
believe
the problem is likely to be in a slightly different branch of the
registry,
due to a typo on the MSDN page. (This typo was corrected over the
weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no
rights.
===============================

KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


:

Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image
you
should have Enabled=dword:0.

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in
the
fbalog.txt and verified the registry entries are all there. But
after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable
to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 
K

KM

Benjamin,

Sorry for a long response but I was out of my desk for a couple of days.

Although there were some minor differences between the reg.settings you
showed and mine own similar setup here, they looked ok.
You should really tell us whether EWF is working on your image or not.

The "Unable to find an Ewf volume." message for ewfmgr command is ok in EWF
RAM Reg mode. (I guess this is what you wanted)
So what do you see when you type ewfmgr c:?
Also, do the changes you make in the image persist over reboots? E.g., if
you make some change in registry and gracefully reboot, do you see the
registry modifications?
If not, the EWF is working perfectly for you.

KM
Matt Kellner,

I checked again, but the name of the registry key is correct without the
period as you mentioned. Do you have any idea? Thanks.

B. Rgds,
Benjamin

Matt Kellner (MS) said:
Benjamin, see my reply to your original message in this thread - I
believe
the problem is likely to be in a slightly different branch of the
registry,
due to a typo on the MSDN page. (This typo was corrected over the
weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no
rights.
===============================

Benjamin said:
KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


:

Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image
you
should have Enabled=dword:0.

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in
the
fbalog.txt and verified the registry entries are all there. But
after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable
to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 
G

Guest

KM,

It is my mistake. As you said, when I type ewfmgr c: the message looks ok.
After I save a file on c:\ and reboot, the file disappeared. The EWF works
well, right? Thanks!

Benjamin

KM said:
Benjamin,

Sorry for a long response but I was out of my desk for a couple of days.

Although there were some minor differences between the reg.settings you
showed and mine own similar setup here, they looked ok.
You should really tell us whether EWF is working on your image or not.

The "Unable to find an Ewf volume." message for ewfmgr command is ok in EWF
RAM Reg mode. (I guess this is what you wanted)
So what do you see when you type ewfmgr c:?
Also, do the changes you make in the image persist over reboots? E.g., if
you make some change in registry and gracefully reboot, do you see the
registry modifications?
If not, the EWF is working perfectly for you.

KM
Matt Kellner,

I checked again, but the name of the registry key is correct without the
period as you mentioned. Do you have any idea? Thanks.

B. Rgds,
Benjamin

Matt Kellner (MS) said:
Benjamin, see my reply to your original message in this thread - I
believe
the problem is likely to be in a slightly different branch of the
registry,
due to a typo on the MSDN page. (This typo was corrected over the
weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no
rights.
===============================

KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


:

Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image
you
should have Enabled=dword:0.

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in
the
fbalog.txt and verified the registry entries are all there. But
after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable
to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 
K

KM

Benjamin,
It is my mistake. As you said, when I type ewfmgr c: the message looks ok.
After I save a file on c:\ and reboot, the file disappeared. The EWF works
well, right? Thanks!
Click to expand...


Yes, it does.
Glad we figured that out :)

KM
KM said:
Benjamin,

Sorry for a long response but I was out of my desk for a couple of days.

Although there were some minor differences between the reg.settings you
showed and mine own similar setup here, they looked ok.
You should really tell us whether EWF is working on your image or not.

The "Unable to find an Ewf volume." message for ewfmgr command is ok in EWF
RAM Reg mode. (I guess this is what you wanted)
So what do you see when you type ewfmgr c:?
Also, do the changes you make in the image persist over reboots? E.g., if
you make some change in registry and gracefully reboot, do you see the
registry modifications?
If not, the EWF is working perfectly for you.

KM
Matt Kellner,

I checked again, but the name of the registry key is correct without the
period as you mentioned. Do you have any idea? Thanks.

B. Rgds,
Benjamin

:

Benjamin, see my reply to your original message in this thread - I
believe
the problem is likely to be in a slightly different branch of the
registry,
due to a typo on the MSDN page. (This typo was corrected over the
weekend,
by the way.)

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no
rights.
===============================

KM,

I set Enabled=dword:0 in pre-FBA image and Enabled=dword:1 in post-FBA
image
as you said.

The following is the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys
exported:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000001
"Type"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Hope your further help!

Best Rgds,
Benjamin


:

Benjamin,

Did you have the Type value set up under
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ]?
Can you export and show us the content of the
[HKLM\SYSTEM\CurrentControlSet\Services\ewf ] key with all subkeys?

KM

PS. Hope you set Enabled=dword:1 in post-FBA image. In pre-FBA image
you
should have Enabled=dword:0.

Hi Group,

I followed the instructions in
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp
and configured my XPE sp2 image including
[HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0],Enabled=dword:1.
After the FBA process, I couldn't found any message about "ewf" in
the
fbalog.txt and verified the registry entries are all there. But
after a
reboot I input the "ewfmge.exe" in cmd and got the message "unable
to
find an
ewf volume". What did I do wrong with the configuration?

Your any help will be appreciated in advance!

Best Rgds,
Benjamin
Click to expand...
Click to expand...
Click to expand...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

EWF RAM Reg with two drives 1
EWF in WES 4
EWF RAM problem 2
ewf ram-reg, inconsistent documentation 7
CompactFlash with EWF RAM reg 3
EWF USB RAM REG -> Wrong Volume Protected 4
Blue screen while deploying EWF RAM Reg mode 2
EWF RAM Reg and BSOD 7B 1

Top