EWF in SP2 Not Working

[Guest]

I posted a bug. I also *trumpet fanfare* got it WORKING!

Here's what seems to make the difference:
Follow all directions for RAM Reg mode EWF except these:
DON'T Disable the DLL/COM registration as specified. I get the old-style
extra type 45 or whatever partition on the disk, but EWF comes up disabled as
it should.
DON'T add ANY reg settings until such time as you want it enabled, then you
can use the old-school method of changing the registry, or can use the EWFMGR
command-line or the API.

"Of course, there are still a few bugs in the system." -B.D.

 

[Matt Kellner \(MS\)]

That's interesting. Basically, if I'm reading you right, all you're doing
at this point is setting up a basic RAM overlay, and then going and making
the required modifications manually. That is, as I understand it, the old
process, and it requires that there be a blank, unpartitioned area on the
target hard drive where EWF can set up a partition.

The purpose of the MSDN article is to circumvent the need for a separate EWF
partition, and to have EWF configured for RAM Reg operation when it finishes
FBA. This should simplify the process.

I did identify a typo in our instructions that may have been causing some
problems, however - please see my new thread titled "Resolution for EWF RAM
REG 'Incorrect Function' issue" for more information.

In Step 8 of the instuctions, a reg key is called out that has a period at
the end:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.

This key should not have a period at the end - this will cause the data
underneath it to be stored at the wrong location, and thus the system will
never pick up the EWF component. Simply remove the period when entering
this information into Target Designer, and this should resolve the problem.
We're taking steps to correct this error as well, and we apologize for the
confusion.

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================

 

[Slobodan Brcin \(eMVP\)]

Kilarny,

ewf.sys driver is filter based driver which is extremely simple and do not need any dependencies on other drivers and files.
Registry based EWF is solely configured trough registry, and all issues that you and other are experiencing is that you do not add
all registry entries correctly. Please note that MS documentation is uncomplete regarding the needed registry entries.

You can verify this by simple test.
From your current working Reg RAM EWF XPe use regedit to export two reg files with:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

Then do this from your XPe image made according to the MS documentation.
Compare them and you will see the differences. Also you can port them here.

Regards,
Slobodan