EWF error 1

  • Thread starter Thread starter Maarten
  • Start date Start date
M

Maarten

Hi guys,

I have on my PC a hard disk with 2 partitions and 2 G
unallocated. On C: I have XP pro, and on the an XPE image
with EWF in it. It loads fine, but ewfmgr doesn't find an
ewfvolume. ewfmgr c:(and d:) says ...error 1

The image contains EWF and EWF ntldr (both with hotfixes)
and ewfmgr components. Further command shell,min logon,
ntfs, ide (2*), PnP sw device enumerator, and the rest of
the minimal required components.
I configured EWF with 2 protected volumes 1 (c)with ide
and disk, and 2 (d) with ide and ram. I made the
ewfpartition size 40000kb. The rest of the settings I
kept standard.

What can I be missing?

TIA,
Maarten
 
Both partitions are primary. 1 = c and the boot
partition, it contains XPpro. 2 = d and contains XPE.
After booting there is now an extra(unknown) partion 0f
39Mb. That must be the partition created during fba. I
suppose the space was taken from the 2G unallocated.

I replaced ntldr on c with the one provided by the build
(the ewf ntldr).

The 40000kb is an ewf component setting, i chose 40Mb
because the image is 38Mb.

For the other settings I pretty much followed JB Cseri's
book (start ewf enabled, no lazy writes, optimal
performance

the interesting part of the log looks ok:

--------------
12:20:45 PM - [FBADoReboot] Sleeping...
12:20:55 PM - [FBADoReboot] Exiting process...
12:21:31 PM - ConfigureEwf() Start.

12:21:31 PM - Getting EWF config parameters from
registry.

12:21:31 PM - Non El Torito disk configuration.

12:21:31 PM - EWF Partition Size = 40000 (KBytes),
Levels = 1, Volumes = 2.

12:21:31 PM - Protected Volume Config #0 :

12:21:31 PM - Disk= 0,Part= 1,DiskType= IDE,Type=
Disk.

12:21:31 PM - Enable= Enabled, Optimize= 0,
LazyWrite= N.

12:21:31 PM - Protected Volume Config #1 :

12:21:31 PM - Disk= 0,Part= 2,DiskType= IDE,Type= RAM.

12:21:32 PM - Enable= Enabled, Optimize= 0,
LazyWrite= N.

12:21:32 PM - Found 1 Hard Disks.

12:21:32 PM - Disk #0 layout info:

12:21:32 PM - PRIMARY
partition,start=0x0000000000007e00,
len=0x00000000bff38200, type= 7

12:21:32 PM - PRIMARY
partition,start=0x00000000bff40000,
len=0x00000000bff40000, type= 7

12:21:32 PM - FREE partition,start=0x000000017fe80000,
len=0x0000000077f88000, type= 0

12:21:32 PM - Allocating EWF in PRIMARY partition,
start=0x000000017fe80000, len=0x0000000002711400.

12:21:32 PM - Created EWF partition on Disk = 0,
partition = 3,size = 0x0000000002711400 .

12:21:32 PM - ewfOpen.

12:21:32 PM - EWF Volume Config on Disk#0, Partition#3:

12:21:32 PM - Segments = 624, Max Volumes = 2, Max
Levels = 1

12:21:33 PM - ewfAdd.

12:21:33 PM - Protected Volume Config on Disk0
\Partition1 :

12:21:33 PM - Type = DISK, State= ENABLED.

12:21:33 PM - ewfAdd.

12:21:33 PM - Protected Volume Config on Disk0
\Partition2 :

12:21:33 PM - Type = RAM, State= ENABLED.

12:21:33 PM - ewfClose

12:21:33 PM - ConfigureEwf() End, status = 0x0.

12:21:33 PM - [CallEntryPointThread] d:\WINDOWS\system32
\ewfdll.dll, ConfigureEwf
12:21:33 PM - [FBASetProgressText] Resetting Setup
Flag...
12:21:34 PM - [FBADoReboot] Sleeping...
12:21:44 PM - [FBADoReboot] Rebooting system...
--------------

I already read a lot about the matter and really expected
this to work...

I am also up to date with the hotfixes...
 
I'm too tired and probably because of that I can't see any error in your FBA
log :(

Regards,
Slobodan

Maarten said:
Both partitions are primary. 1 = c and the boot
partition, it contains XPpro. 2 = d and contains XPE.
After booting there is now an extra(unknown) partion 0f
39Mb. That must be the partition created during fba. I
suppose the space was taken from the 2G unallocated.

I replaced ntldr on c with the one provided by the build
(the ewf ntldr).

The 40000kb is an ewf component setting, i chose 40Mb
because the image is 38Mb.

For the other settings I pretty much followed JB Cseri's
book (start ewf enabled, no lazy writes, optimal
performance

the interesting part of the log looks ok:

--------------
12:20:45 PM - [FBADoReboot] Sleeping...
12:20:55 PM - [FBADoReboot] Exiting process...
12:21:31 PM - ConfigureEwf() Start.

12:21:31 PM - Getting EWF config parameters from
registry.

12:21:31 PM - Non El Torito disk configuration.

12:21:31 PM - EWF Partition Size = 40000 (KBytes),
Levels = 1, Volumes = 2.

12:21:31 PM - Protected Volume Config #0 :

12:21:31 PM - Disk= 0,Part= 1,DiskType= IDE,Type=
Disk.

12:21:31 PM - Enable= Enabled, Optimize= 0,
LazyWrite= N.

12:21:31 PM - Protected Volume Config #1 :

12:21:31 PM - Disk= 0,Part= 2,DiskType= IDE,Type= RAM.

12:21:32 PM - Enable= Enabled, Optimize= 0,
LazyWrite= N.

12:21:32 PM - Found 1 Hard Disks.

12:21:32 PM - Disk #0 layout info:

12:21:32 PM - PRIMARY
partition,start=0x0000000000007e00,
len=0x00000000bff38200, type= 7

12:21:32 PM - PRIMARY
partition,start=0x00000000bff40000,
len=0x00000000bff40000, type= 7

12:21:32 PM - FREE partition,start=0x000000017fe80000,
len=0x0000000077f88000, type= 0

12:21:32 PM - Allocating EWF in PRIMARY partition,
start=0x000000017fe80000, len=0x0000000002711400.

12:21:32 PM - Created EWF partition on Disk = 0,
partition = 3,size = 0x0000000002711400 .

12:21:32 PM - ewfOpen.

12:21:32 PM - EWF Volume Config on Disk#0, Partition#3:

12:21:32 PM - Segments = 624, Max Volumes = 2, Max
Levels = 1

12:21:33 PM - ewfAdd.

12:21:33 PM - Protected Volume Config on Disk0
\Partition1 :

12:21:33 PM - Type = DISK, State= ENABLED.

12:21:33 PM - ewfAdd.

12:21:33 PM - Protected Volume Config on Disk0
\Partition2 :

12:21:33 PM - Type = RAM, State= ENABLED.

12:21:33 PM - ewfClose

12:21:33 PM - ConfigureEwf() End, status = 0x0.

12:21:33 PM - [CallEntryPointThread] d:\WINDOWS\system32
\ewfdll.dll, ConfigureEwf
12:21:33 PM - [FBASetProgressText] Resetting Setup
Flag...
12:21:34 PM - [FBADoReboot] Sleeping...
12:21:44 PM - [FBADoReboot] Rebooting system...
--------------

I already read a lot about the matter and really expected
this to work...

I am also up to date with the hotfixes...








-----Original Message-----
Maarten,

Could you clarify this "I made the ewfpartition size 40000kb"?

Also, tell us how is your drive partitioned exactly? 2 primary partitions,
or 1 primary, 1 extended? Is the free space within the extended partition or
not?
What does your FBALog.txt say? Particulary about EWF config?

Also, check all the previous posts on the subject:
http://groups.google.com/groups?hl=en&lr=&ie=UTF- 8&oe=UTF-8&q=EWF+error+1&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*


.
Click to expand...
Click to expand...
 
Maarten,

I don't see any error in FBA log either.

A few directions to go:

1) Do you have "PnP (User-mode)" component in your image?

2) If not 1), try to set initial step of the EWF to disabled. Then run FBA and enable EWF manually (this way your FBAlog will
reflect real changes up to the end).

3) If 1) and 2) did not work, try protecting only one partition - RAM overlay only first, then Disk overlay only, then both
together. Painful, I know, but only way I now see to figure out the problem. Check FBALog on any step.

--
KM,
BSquare Corporation
Both partitions are primary. 1 = c and the boot
partition, it contains XPpro. 2 = d and contains XPE.
After booting there is now an extra(unknown) partion 0f
39Mb. That must be the partition created during fba. I
suppose the space was taken from the 2G unallocated.

I replaced ntldr on c with the one provided by the build
(the ewf ntldr).

The 40000kb is an ewf component setting, i chose 40Mb
because the image is 38Mb.

For the other settings I pretty much followed JB Cseri's
book (start ewf enabled, no lazy writes, optimal
performance

the interesting part of the log looks ok:

--------------
12:20:45 PM - [FBADoReboot] Sleeping...
12:20:55 PM - [FBADoReboot] Exiting process...
12:21:31 PM - ConfigureEwf() Start.

12:21:31 PM - Getting EWF config parameters from
registry.

12:21:31 PM - Non El Torito disk configuration.

12:21:31 PM - EWF Partition Size = 40000 (KBytes),
Levels = 1, Volumes = 2.

12:21:31 PM - Protected Volume Config #0 :

12:21:31 PM - Disk= 0,Part= 1,DiskType= IDE,Type=
Disk.

12:21:31 PM - Enable= Enabled, Optimize= 0,
LazyWrite= N.

12:21:31 PM - Protected Volume Config #1 :

12:21:31 PM - Disk= 0,Part= 2,DiskType= IDE,Type= RAM.

12:21:32 PM - Enable= Enabled, Optimize= 0,
LazyWrite= N.

12:21:32 PM - Found 1 Hard Disks.

12:21:32 PM - Disk #0 layout info:

12:21:32 PM - PRIMARY
partition,start=0x0000000000007e00,
len=0x00000000bff38200, type= 7

12:21:32 PM - PRIMARY
partition,start=0x00000000bff40000,
len=0x00000000bff40000, type= 7

12:21:32 PM - FREE partition,start=0x000000017fe80000,
len=0x0000000077f88000, type= 0

12:21:32 PM - Allocating EWF in PRIMARY partition,
start=0x000000017fe80000, len=0x0000000002711400.

12:21:32 PM - Created EWF partition on Disk = 0,
partition = 3,size = 0x0000000002711400 .

12:21:32 PM - ewfOpen.

12:21:32 PM - EWF Volume Config on Disk#0, Partition#3:

12:21:32 PM - Segments = 624, Max Volumes = 2, Max
Levels = 1

12:21:33 PM - ewfAdd.

12:21:33 PM - Protected Volume Config on Disk0
\Partition1 :

12:21:33 PM - Type = DISK, State= ENABLED.

12:21:33 PM - ewfAdd.

12:21:33 PM - Protected Volume Config on Disk0
\Partition2 :

12:21:33 PM - Type = RAM, State= ENABLED.

12:21:33 PM - ewfClose

12:21:33 PM - ConfigureEwf() End, status = 0x0.

12:21:33 PM - [CallEntryPointThread] d:\WINDOWS\system32
\ewfdll.dll, ConfigureEwf
12:21:33 PM - [FBASetProgressText] Resetting Setup
Flag...
12:21:34 PM - [FBADoReboot] Sleeping...
12:21:44 PM - [FBADoReboot] Rebooting system...
--------------

I already read a lot about the matter and really expected
this to work...

I am also up to date with the hotfixes...








-----Original Message-----
Maarten,

Could you clarify this "I made the ewfpartition size 40000kb"?

Also, tell us how is your drive partitioned exactly? 2 primary partitions,
or 1 primary, 1 extended? Is the free space within the extended partition or
not?
What does your FBALog.txt say? Particulary about EWF config?

Also, check all the previous posts on the subject:
http://groups.google.com/groups?hl=en&lr=&ie=UTF- 8&oe=UTF-8&q=EWF+error+1&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*


.
Click to expand...
Click to expand...
 
YES! It works now.

I added PnP usermode (I thought I had pnp, but that was
auto-added kernel mode), re-enabled some components that
are not necessary in nonewf image, and used ram-on-c only.
Now I'll try to optimize the image again...

Thanks
Maarten
 
Back
Top