EWF in WES

[Bhentai]

Hi, I have switched from XPe to WES recently and I've got a problem with EWF.
When using the ewfmgr to enable EWF, I get this error message:

ewfmgr c: enable

Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

Failed opening the target device \\.\en with error 2
the system cannot find the file specified

I then checked the FBA log and there was no EWF partition created during
FBA. Actually, EWF is not even mentionned in the log. I don't understand
since I've all EWF components included in my image. What is causing this?

Ben

 

[Srikanth Kamath [MSFT]]

Hi Bhentai

If you choose RAM REG for one or more protected volumes in the target
desinger , it will be imposed on all configurations. Since EWF RAM REG has
its configuration stored in the registry, all the work needed to configure it
is done in Target Designer itself. There will not be any additional EWF
related work during FBA. That explains why you don't see any EWF related logs
in FBA.log and why you don't have a EWF partition.


However, the error you are seeing is not very clear to me. Could you please
share the following -

(1) output of
(a) ewfmgr /all
(b) ewfmgr
(2) EWF config information in the registry . You can run the following
command.
reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1

You'll have a entry under -
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected
for each protected volume.

Provide me the full output.


Thanks
Srikanth



--
For questions on EWF, HORM and other EEFs - use our MSDN EEF forum
http://social.msdn.microsoft.com/forums/en-US/embeddedwindowseefs/threads/

Hi, I have switched from XPe to WES recently and I've got a problem with EWF.
When using the ewfmgr to enable EWF, I get this error message:

ewfmgr c: enable

Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

Failed opening the target device \\.\en with error 2
the system cannot find the file specified

I then checked the FBA log and there was no EWF partition created during
FBA. Actually, EWF is not even mentionned in the log. I don't understand
since I've all EWF components included in my image. What is causing this?

Ben

 

[Bhentai]

Hi Srikanth, here's want you wanted me to provided:

output of
(a) ewfmgr /all

ewfmgr /all

Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

(1) output of
(b) ewfmgr

ewfmgr

RAM (REG) Configuration
Device Name "\Device\HardidiskVolume1" [C:]
HORM Not Supported

2) EWF config information in the registry .
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

ArcName REG_SZ multi(0)disk(0)rdisk(0)partion(1)
CompareBeforeAlloc REG_DWORD 0x00000000(0)
Enabled REG_DWORD 0x00000000(0)
Type REG_DWORD 0x00000001(1)

HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1
This key doesn't exit

Hpe this will help!!

Hi Bhentai

If you choose RAM REG for one or more protected volumes in the target
desinger , it will be imposed on all configurations. Since EWF RAM REG has
its configuration stored in the registry, all the work needed to configure it
is done in Target Designer itself. There will not be any additional EWF
related work during FBA. That explains why you don't see any EWF related logs
in FBA.log and why you don't have a EWF partition.


However, the error you are seeing is not very clear to me. Could you please
share the following -

(1) output of
(a) ewfmgr /all
(b) ewfmgr
(2) EWF config information in the registry . You can run the following
command.
reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1

You'll have a entry under -
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected
for each protected volume.

Provide me the full output.


Thanks
Srikanth



--
For questions on EWF, HORM and other EEFs - use our MSDN EEF forum
http://social.msdn.microsoft.com/forums/en-US/embeddedwindowseefs/threads/

Hi, I have switched from XPe to WES recently and I've got a problem with EWF.
When using the ewfmgr to enable EWF, I get this error message:

ewfmgr c: enable

Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

Failed opening the target device \\.\en with error 2
the system cannot find the file specified

I then checked the FBA log and there was no EWF partition created during
FBA. Actually, EWF is not even mentionned in the log. I don't understand
since I've all EWF components included in my image. What is causing this?

Ben

 

[Srikanth Kamath [MSFT]]

Thanks for providing the info. EWF is correctly configured. The error you are
seeing is due to a trivial mistake (I can't believe I did not notice it
earlier )

You should use
<ewfmgr C: /enable>
or
<ewfmgr C: -enable>
and not
<ewfmgr C: enable>

ie '/enable' or '-enable' and not plain 'enable'. If you use 'enable',
ewfmgr will not see it as a switch instead it will treat it as a drive letter
and try to open it , hence the error.

That should solve your problem.

Thanks
Srikanth
--
For questions on EWF, HORM and other EEFs - use our MSDN EEF forum
http://social.msdn.microsoft.com/forums/en-US/embeddedwindowseefs/threads/

Hi Srikanth, here's want you wanted me to provided:

output of
(a) ewfmgr /all

ewfmgr /all

Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

(1) output of
(b) ewfmgr

ewfmgr

RAM (REG) Configuration
Device Name "\Device\HardidiskVolume1" [C:]
HORM Not Supported

2) EWF config information in the registry .
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

ArcName REG_SZ multi(0)disk(0)rdisk(0)partion(1)
CompareBeforeAlloc REG_DWORD 0x00000000(0)
Enabled REG_DWORD 0x00000000(0)
Type REG_DWORD 0x00000001(1)

HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1
This key doesn't exit

Hpe this will help!!

Hi Bhentai

If you choose RAM REG for one or more protected volumes in the target
desinger , it will be imposed on all configurations. Since EWF RAM REG has
its configuration stored in the registry, all the work needed to configure it
is done in Target Designer itself. There will not be any additional EWF
related work during FBA. That explains why you don't see any EWF related logs
in FBA.log and why you don't have a EWF partition.


However, the error you are seeing is not very clear to me. Could you please
share the following -

(1) output of
(a) ewfmgr /all
(b) ewfmgr
(2) EWF config information in the registry . You can run the following
command.
reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1

You'll have a entry under -
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected
for each protected volume.

Provide me the full output.


Thanks
Srikanth



--
For questions on EWF, HORM and other EEFs - use our MSDN EEF forum
http://social.msdn.microsoft.com/forums/en-US/embeddedwindowseefs/threads/

Hi, I have switched from XPe to WES recently and I've got a problem with EWF.
When using the ewfmgr to enable EWF, I get this error message:

ewfmgr c: enable
Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

Failed opening the target device \\.\en with error 2
the system cannot find the file specified

I then checked the FBA log and there was no EWF partition created during
FBA. Actually, EWF is not even mentionned in the log. I don't understand
since I've all EWF components included in my image. What is causing this?

Ben

 

[Bhentai]

Thanks a lot Srikanth, it was really that simple. Maybe the output should be
clearer when using a "wrong" argument with ewfmgr!!

Anyway, thanks a lot again

Regards

Ben

Thanks for providing the info. EWF is correctly configured. The error you are
seeing is due to a trivial mistake (I can't believe I did not notice it
earlier )

You should use
<ewfmgr C: /enable>
or
<ewfmgr C: -enable>
and not
<ewfmgr C: enable>

ie '/enable' or '-enable' and not plain 'enable'. If you use 'enable',
ewfmgr will not see it as a switch instead it will treat it as a drive letter
and try to open it , hence the error.

That should solve your problem.

Thanks
Srikanth
--
For questions on EWF, HORM and other EEFs - use our MSDN EEF forum
http://social.msdn.microsoft.com/forums/en-US/embeddedwindowseefs/threads/

Hi Srikanth, here's want you wanted me to provided:

output of
(a) ewfmgr /all

ewfmgr /all

Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

(1) output of
(b) ewfmgr

ewfmgr

RAM (REG) Configuration
Device Name "\Device\HardidiskVolume1" [C:]
HORM Not Supported

2) EWF config information in the registry .
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

ArcName REG_SZ multi(0)disk(0)rdisk(0)partion(1)
CompareBeforeAlloc REG_DWORD 0x00000000(0)
Enabled REG_DWORD 0x00000000(0)
Type REG_DWORD 0x00000001(1)

HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1
This key doesn't exit

Hpe this will help!!

Hi Bhentai

If you choose RAM REG for one or more protected volumes in the target
desinger , it will be imposed on all configurations. Since EWF RAM REG has
its configuration stored in the registry, all the work needed to configure it
is done in Target Designer itself. There will not be any additional EWF
related work during FBA. That explains why you don't see any EWF related logs
in FBA.log and why you don't have a EWF partition.


However, the error you are seeing is not very clear to me. Could you please
share the following -

(1) output of
(a) ewfmgr /all
(b) ewfmgr
(2) EWF config information in the registry . You can run the following
command.
reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0

reg.exe query
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected\Volume1

You'll have a entry under -
HKLM\System\CurrentControlSet\Services\EWF\Parameters\Protected
for each protected volume.

Provide me the full output.


Thanks
Srikanth



--
For questions on EWF, HORM and other EEFs - use our MSDN EEF forum
http://social.msdn.microsoft.com/forums/en-US/embeddedwindowseefs/threads/


:

Hi, I have switched from XPe to WES recently and I've got a problem with EWF.
When using the ewfmgr to enable EWF, I get this error message:

ewfmgr c: enable
Protected volume Configuration
Type RAM (REG)
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID F0 0E 20 C8 007E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level N/A
Memory used for data 0 bytes
Memory used for mappuing 0 bytes

Failed opening the target device \\.\en with error 2
the system cannot find the file specified

I then checked the FBA log and there was no EWF partition created during
FBA. Actually, EWF is not even mentionned in the log. I don't understand
since I've all EWF components included in my image. What is causing this?

Ben