EWF USB RAM REG -> Wrong Volume Protected

[Stefan Pflaume \(XPe\)]

Hello,

I installed a USB Stick with EWF Ram Reg.

After enable EWF everything is OK.

The USB Stick is protected, and I get a positive feedback from the
ewfmgnr.exe



Then I have added an internal RAID for Video Data.

Now EWF is protecting the Raid Volume and not the USB Stick.



I tried to change the ArcName in the registry, but after

"Rundll ewfdll.dll ConfigureEwf" this values changes back to 0/0/0/1.



Is there a way to change the EWF to protect the USB Stick, even after adding
a HD?

Should I use VolumeID in the Registry, and how to find the ID of the USB
Stick?



The boot.ini is still pointing to 0/0/0/1! But I think this is the RAID?!



Thank you for any tip!



Kind Regards



Stefan

 

[Stefan Pflaume \(XPe\)]

Ok, still not solved, but here are a bit more information:



When I start the system with detached RAID, the EWF is working fine on the
USB Stick.
After attaching the RAID, it seems that the USB stick is moving from
Disk(0)Partition(1) to Disk(1)Partition(1). In the boot.ini is still
Disk(0)Partition(1).

The RAID driver is loading in Windows, so it seems, that the ARCPath is
changing while booting.
When I change the registry settings under EWF to Disk(1)Partition(1) the
ewfmgr still wants to protect the RAID.



The Diskmanager shows the RAID as Disk 0 and the USB Stick as Disk 1



Is there any way to change the RAID to Disk(1)Partition(1)?



Regards



Stefan

 

[Stefan Pflaume \(XPe\)]

Ok, I solve the problem.

I changed the reg value PVDisk to 1
rund rundll32.exe ewfdll.dll ConfigureEwf
restart XPe
enable EWF with EWFMGR.EXE C: -enable

Now the EWF is working!

 

[Godzilla]

Ok, I solve the problem.

I changed the reg value PVDisk to 1
rund rundll32.exe ewfdll.dll ConfigureEwf
restart XPe
enable EWF with EWFMGR.EXE C: -enable

Now the EWF is working!

Thanks for sharing the solution, mate. Cheers!

 

[Stefan Pflaume \(XPe\)]

Let me say it that way:

Partly Solved!

The problem is, that I am not sure, at witch point the USB Stick is changing
from Disk(0)Partition(1) to Disk(1)Partition(1). Until that point, there is
no write protection to the USB device. I my mind, this should happen when
the RAID driver is loading, but I am not sure, maybe it is a BIOS thing.
So, if you have e.g. a power loss while booting, it could be, that the USB
stick is not protected!



If anyone has an idea how when the EWF is getting active, please share it
with me!



Regards



Stefan

Ok, I solve the problem.

I changed the reg value PVDisk to 1
rund rundll32.exe ewfdll.dll ConfigureEwf
restart XPe
enable EWF with EWFMGR.EXE C: -enable

Now the EWF is working!

Thanks for sharing the solution, mate. Cheers!