EWF Component

[George]

add these three components:
Enhanced Write Filter
EWF Manager Console application
EWF NTLDR

If you want to make image with RAM-based, after FBA it will work.
If you want to make image with Disk-based,after FBA you should reboot again,
then it will work.

Resource:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/htm
l/xeconenhancedwritefilter.asp

 

[Mule Skinner]

I followed the instructions provided with the files on XPeFiles "RAMEWF" by
Slobodan.
I have a few questions. Build went fine, FBA went fine, however EWF isn't
blocking writes.
The only thing I did differently on the instructions was in Target Designer,
when setting the key values, I had to choose Integer instead of Dword, on
Enabled=0 and Type=1.


When I perform a EWFMGR C: -enable I get
"Failed Getting protected volume configuration Error 1, just like Sloboan
describes.

So, If this error and the "Unable to find an EWF Volume" is always normal
behavior, how can one actually tell or verify it's working.

I know mines not, I can create a file then reboot and the file is on disk.
Any suggestions?

Thanks Richard

 

[Slobodan Brcin \(eMVP\)]

Hi Mule,

You should remove MS "Enhanced Write Filter" component.
Add my component do not set anything. Default is probably ok for you.

EWFMGR C: -enable
Should work. Error that you describe is not a normal behavior for ewfmgr C: ... command.

Do you have user mode pnp component.
Do you have system or admin privileges when calling ewfmgr?


Regards,
Slobodan

 

[Mule Skinner]

Okay, I understand. I edited the wrong file. I did it like you said,
leaving the defaults, however during the build, I get an error: File not
found 818822_ewfapi.dll

Richard

 

[Mule Skinner]

Still broke, missing files EWFAPI.dll

Yes PNP (UserMode) is in there.
Using Admin account.

I have EWF Manager Console
EWF NTLDR
EWF Ram Registery

(I Removed Enhanced Write Filter Hot Fix Q823025) like you suggested.

Richard

 

[Slobodan Brcin \(eMVP\)]

Windows Embedded Data\Repositories\{41B0394B-74D8-4CFD-86C0-BDCE45CE4728}\818822_ewfapi.dll
This file is part of some QFE update. You can disable this file in TD it is not essential for EWF to work. This is user API for
manipulating EWF.

Regards,
Slobodan

 

[Richard]

Yes, it appears to work fine without that file. Thanks,

Richard

 

[Nicolas BESSON]

Hi Slobodan,

What happens if the PNP (User Mode) component is not added to the image ?

Because i don't want this component in my image, but i want EWF enabled.

Nicolas

 

[Slobodan Brcin \(eMVP\)]

Hi Nicolas,

I do not know. I always have it in my images. I thought that someone said that it will not work. (Or at least install).
So if it is not installing without PnP User component try adding it. And after EWF is set-up disable it in run-time XPe.

You will have to try this.

Regards,
Slobodan