EWF in SP2 Not Working

[Guest]

I've gotten EWF to work before (in SP1 and original XPE). My previous
method, basically the same as what other topics cover, worked fine. Now,
using SP2, it does not work. My first pass I did nothing aside from adding a
few components we needed and Upgrading the entire config - all using a
previous .SLX that ran EWF just fine.

I've got the PnP component, I've set up the EWF components as described in
the new improved help files (0 Kbytes size, don't start enabled, disable
DLL/COM Registration, etc). I've got only a single partition on the target
drive I'm building on. I have tried various timings and methods for adding
the registry settings required, and variants on the same.

In other words, I THOUGHT I had everything correct. However, I get the
'Failed to find EWF Volume' and 'Failed getting protected volume
configuration with error 1. Incorrect function.' error messages when I try
EWFMGR and EWFMGR C:.

This note in the Help file Troubleshooting section caught my attention, but
I'm not sure what it is I can DO about it. I'm not certain it applies to RAM
EWF type anyway. There are no specific drivers for my Disk Drive type - do I
need to MAKE a component for this?

"Verify that you are using a specific disk driver in your run-time image,
and not a generic disk driver. If you use EWF with a generic disk driver, the
EWF volume may not always be created."

Besides that, the drive I'm making this work on isn't going to be the final
device used. I'm creating the image on a Hard Drive then moving to Compact
Flash afterwards.

Much gratitude for any assistance that might be rendered, O Community.

 

[Slobodan Brcin \(eMVP\)]

Hi Kilarny,

Make sure that you have "EWF" value mentioned under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.\Upperfilters
Use regedit fro that purpose.

Regards,
Slobodan

 

[Guest]

Yep, got that one too. I was not clear on whether the 'volsnap' entry, if
found, should be a separate String value or should be concatenated with the
'EWF' - in other words should that be 'volsnap EWF' or:
volsnap
EWF

Thanks for the quick reply...

 

[Slobodan Brcin \(eMVP\)]

Kilarny,

This represent two separate filter drivers so you should add them as separate lines.

volsnap
EWF

Do you have it?

Regards,
Slobodan

 

[Guest]

Nope, didn't have them separate. Now, I guess I need to have FBA run again
with the proper entries there?

 

[Slobodan Brcin \(eMVP\)]

Hi Kilarny,

Nope, didn't have them separate. Now, I guess I need to have FBA run again
with the proper entries there?

You can try just to reboot computer, but if there is no EWF overlay partition it won't work.

BTW:
Also check fba.log for info about EWF overlay creation.

Regards,
Slobodan

 

[Guest]

Running with the corrected volsnap EWF entries (on separate lines) didn't
help. I still get the same error state.

I did previously check the FBALOG.TXT and there was no EWF configuration at
all. The FBA is not even trying to look up the EWF configuration. I did a
build with 'Start EWF Enabled' checked just to see if that would happen.
There were no EWF messages in the log, very strange.

I'm probably missing something REALLY obvious, but it has yet to slap me in
the face like a dead fish.

 

[Slobodan Brcin \(eMVP\)]

Hi Kilarny,

If you don't have anything in the FBA log then it might be that you have used reg ram ewf aproach and then tried to switch to disk
overlay, if so then you should remove EWF component and add it again to image so that call that tell FBA to initialize EWF is
executed .

Regards,
Slobodan

 

[Guest]

Doesn't seem to be that either. I readded the component, dependancy checked,
ran it - no dice. *ponders*

Thanks for the help. Slobodan...I'll look into that, try from scratch, etc.
I appreciate the assistance, I may beg for more help on Monday. I'll review
my .SLX again and see if I overlooked something.

 

[Nigel Walker]

I have EXACTLY the same problems and symptoms as Kilarny. I have configured
my ssystem the same and I too do not have anything relating to EWF in my FBA
log. This is my brand new build with SP2 and I have only ever tried REG RAM
EWF.

So I would be very interested in any more hints or news!

Regards,
Nigel.

 

[Slobodan Brcin \(eMVP\)]

Nigel,

For Reg RAM EWF it is normal that you do not see log in fba.log file sice you have disabled it as par of process to make it work.
It apears that EWF problems begin to sound as an epidemy outbreak again :-(

Regards,
Slobodan

 

[Nigel Walker]

Ah yes that is true of course.

The thing that worries me is that in the Microsoft notes it says it MAY not
work if using a generic disk driver. Well I'm just using the default driver
which I guess is the generic one. Do you think this may have a bearing on
the problem? If so, where can I get an alternative driver? I find it a bit
weird, especially as I made it work with SP1 - using with your component.

Regards,
Nigel.

 

[Slobodan Brcin \(eMVP\)]

Hi Nigel,

There is only one disk.sys driver and it is provided by MS for all disk types.

Regards,
Slobodan

 

[Nigel Walker]

Hi Slobodan,

I don't know where to look to proceed with this problem. When I check the
registry it shows exactly what should be there according to the Microsoft
documentation, i.e:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf
Name: ErrorControl
Type: REG_DWORD
Value: 0x00000001 (1)
Name: Group
Type: REG_SZ
Value: System Bus Extender
Name: Start
Type: REG_DWORD
Value: 0x00000000 (0)
Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)

The other stuff I had already set up in TD is also as per Microsoft
instructions:

Key Name:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0
Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)
Name: ArcName
Type: REG_SZ
Value: multi(0)disk(0)rdisk(0)partition(1)

Key Name:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.
Name: UpperFilters
Type: REG_MULTI_SZ
Value: EWF

I didn't have a volsnap entry so just added the EWF one.

Do you have EWF RAM REG on SP2 running yourself? If so are there any
differences to how you're doing it?

Regards,
Nigel.

 

[Slobodan Brcin \(eMVP\)]

Hi Nigel,

I have not tried it on final SP2 version, but it worked in Tech Preview.

Regards,
Slobodan

 

[Nigel Walker]

Hi Slobodan,

Could you tell me the significance of the "volsnap" registry entry? Is it
required for EWF?

Is there a way I can try your original scheme that worked with SP1? It
relied on a QFE which I would imagine are now integrated into SP2. Would the
registry entries on your scheme work on SP2 or are they tied to the QFE? I
really am in the dark with these registry entries as I can't find any
documentation on their usage other than "use this".

Any suggestions on what I could try would be most welcome!

Regards,

Nigel.

 

[YaronM]

Hi Nigel,

I've also been strugelling with the new SP2-EWF (check my thread "EWF gives
BSOD").
I've managed to use the original scheme of Slobodan in SP1 for the
EWF-RAM-Registry mode, instead of the SP2-EWF.
it works great without any errors or blue-screens (that I suffered from in
my build).
I removed the SP2-EWF component and added my own component in which I've put
the original ewf.sys/inf from sp1 (the one with the QFE) and the related
registry values as described by Slobodan in the readme file.
I'm using the EWFMGR and the EWF-API from SP2 without any problem.

if you need any assistance - feel free to ask.

Best regards,

YaronM

 

[Nigel Walker]

Hi YaronM,

Thanks for your comments. I have removed all my SP1 stuff so I don't have
the files any more.

Would there be any chance that you could send me your component and files?
My email is nigel at deephaven.co.uk

Regards,

Nigel.

 

[Slobodan Brcin \(eMVP\)]

Hi Nigel,

Search trough repositories folder for file named 823025_ewf.sys it should be there is you installed this QFE.
My component should use that file anyway so it should work.

Regards,
Slobodan

 

[Matt Kellner \(MS\)]

Hi Kilarny and Nigel. Thanks for posting about this issue. We're
investigating issues related to EWF, and we will post a reply to the
newsgroup when we have a solution. To help us investigate this, please
submit a bug report at the following page:
http://msdn.microsoft.com/embedded/community/community/feedback/feedxp/default.aspx -
please include as complete a description of your hardware and software
configurations as possible.

Thanks!

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================