EWF and CompactFlash

[Sören Gessele]

Hi,
iam playing with EWF at the moment and have a small problem. Iam testing
with a CF-Card which is conntected with an adapter to the IDE/ATA-Bus.
The EWF Partition will not be created after the second boot, with the
failure: EWF returned an invalid file handle". Okay. I had a look with
DISKPART and found out, that WinXPe just found a removable boot-drive. And
EWF is not supported with removable drives.
My Question is:
a) From where does WinXPe knows, that this CF-Card is a removable drive? The
PC-Bios shows this CF-Card-Drive as a fixed disk.
b) Is it possible to let WinXPe think, that this drive is a fixed drive?
(Changing the .inf-files?)

Thanks in advance,
Sören

 

[Slobodan Brcin \(eMVP\)]

Hi Sören ,

EWF is not supported with removable drives.

True but RAM EWF can protect one partition regardless of this. If you need more info look at some of documentations on MS or
www.xpefiles.com regarding registry configured RAM EWF.

a) From where does WinXPe knows, that this CF-Card is a removable drive? The
PC-Bios shows this CF-Card-Drive as a fixed disk.

Each BIOS chose it's own way how it will treat and present removable disks.
Nevertheless information is written as one bit that is read from CF. There are CF manufacturer tools that allow you to change this
bit, but usually you must ask for them.

b) Is it possible to let WinXPe think, that this drive is a fixed drive?
(Changing the .inf-files?)

It is not simple as writing inf file.
You will have to create filter driver that will change removable bit to fixed to upper drivers. This can be easily done.

Unfortunately depending on BIOS type there are too many problems related to transition from BIOS (int 13) part of boot phase to
kernel (driver) phase.
It took me months to track most (all) of them and to make appropriate fixes trough drivers. (I'm not talking about CF, but it is
similar thing and problem)


So you should try to:
- Buy CF marked as fixed.
- Obtain tool from CF manufacturer to mark CF as fixed.

Best regards,
Slobodan

 

[Sören Gessele]

Hi Slobodan,
i've already tried the RAM EWF, but i've got the same error-message. Anyway,
i called my dealer and he said, sorry: the card you bought is a customer
card and can't be changed. grrr ;-)

Best regards,
Sören

Hi Sören ,

True but RAM EWF can protect one partition regardless of this. If you need

more info look at some of documentations on MS or

www.xpefiles.com regarding registry configured RAM EWF.


Each BIOS chose it's own way how it will treat and present removable disks.
Nevertheless information is written as one bit that is read from CF. There

are CF manufacturer tools that allow you to change this

bit, but usually you must ask for them.


It is not simple as writing inf file.
You will have to create filter driver that will change removable bit to

fixed to upper drivers. This can be easily done.

Unfortunately depending on BIOS type there are too many problems related

to transition from BIOS (int 13) part of boot phase to

kernel (driver) phase.
It took me months to track most (all) of them and to make appropriate

fixes trough drivers. (I'm not talking about CF, but it is

 

[Richard]

EWF Ram works fine here on removabe media, on over the counter camera style
CF. I have not tried partitions or disk overlay, and I'm sure it would
fail.

I have used standard CF such as Lexar, Sandisk, PNY, Transcend which I use
a variety during development. PNY is about the slowest I've ever seen and I
don't use it anymore. I've lost one Lexar due to unknown reasons (One day
it worked the next day it wasn't even recognized). I used Sandisk
Industrial grade for production units.

I'm using the component from XPEfiles from Slobodan. It does however put in
the FBA Log that EWF can not be enabled on removable media, however this
error has only showed up once or twice for some odd reason, but EWF still
appears to work.
In my other FBA Logs, there is no mention of FBA at all, and they work
equally as well.

We are using the VIA 667 hardware.

Richard

 

[Slobodan Brcin \(eMVP\)]

Hi Sören,

"Windows XP(e)" on removable devices can support only one partition, this is the "limitation" (intended feature) of OS not EWF.
If you use RAM EWF by default is still need second config partition to be created during the FBA.

Fortunately this behaviors can be avoided by disabling EWF volume creation during the FBA and preconfiguring EWF in registry from
TD. My component does that.
This is documented in XPe SP2. Also you can find components and info in my component.

Hi Richard,

It does however put in
the FBA Log that EWF can not be enabled on removable media, however this
error has only showed up once or twice for some odd reason, but EWF still
appears to work.

Actually it does not, and reasons are obvious you forgot to remove MS EWF component from your image. So you have both MS and my EWF
components in you image and this lead to behavior that you describe.
1. MS EWF component will try to create EWF volume during the FBA and fail. This will be logged in fba.log
2. My component will fill all necessary values in registry. And this will allow EWF to work.

My component can't log anything to fba.log because there are no resources registered for configuration during the FBA.

So please find and remove MS EWF component from your image.

Best regards,
Slobodan

 

[Richard]

Hi Richard,

Actually it does not, and reasons are obvious you forgot to remove MS EWF

component from your image. So you have both MS and my EWF

components in you image and this lead to behavior that you describe.
1. MS EWF component will try to create EWF volume during the FBA and fail. This will be logged in fba.log
2. My component will fill all necessary values in registry. And this will allow EWF to work.

Your correct, I remember that one image had the MS EWF in it, after I
removed it there is no longer entries in the FBA log. Thanks for jogging my
memory.