EWF RAM mode error1.

[Guest]

I am now traped, I have been told on this blog only that for EWF RAM mode
.."EWF Partition size in Kbytes" needs to be set to 0 for RAM overlay.
The same I did and build the image, it build properly with no errors and the
FBA process was also quite successful, the image was working fine besides EWF
Filter.

If I run "ewfmgr c:" on cmd prompt i got a error as below:
Failed Getting protected volume configuration with error 1.
Invalid Function.

Now I will tell you what exactly I had done,
See I had a DOM(512MB Fixed Media) on which i had deployed a image with EWF
RAM Mode. I had partitioned this DOM with NTFS and created 1 full primary
partition of 512MB.
After that Enhanced write filter settings are as set:
All default settings as it, besides this I had unchecked "Start EWF Enabled"
checkbox.
EWF Partition size in Kbytes is set to ZERO.
Now please tell me what exactly is the thing I am doing wrong.
Please help.

Amit S. Kadam
India

 

[Guest]

FBALOG.txt File is as pasted below, Its showing that can't create EWF
Partition.
Failed to create EWF Partition.

Copying the last segment of FBA Process from the FBALOG file which is
concern with EWF Configuration.


Wednesday, August 30, 2006

17:24:59 PM - [FBASetProgressText] Setting PNP Flag...
17:25:27 PM - [FBAApplySecurityStringToRegKey] RegSetKeySecurity Failed!
Error: 0x6
17:25:27 PM - [FBAReplaceSecurityInRegistry]
FBAApplySecurityStringToRegKey(009) #1 Failed!
17:25:39 PM - [FBASetProgressText] Initializing...
17:25:39 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBALIB.DLL,
FBAInitialize
17:25:39 PM - [FBASetProgressText] Setting SystemPrefix...
17:25:40 PM - [FBASetProductKey] Evaluation product key
17:25:40 PM - [FBASetProgressText] Initializing User Profiles...
17:25:40 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBALIB.DLL, FBAStep1
17:25:41 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBALIB.DLL,
FBASetSetupInfo
17:25:41 PM - [FBASetProgressText] Installing Components...
17:25:41 PM - [FBALaunch] C:\WINDOWS\Temp\xpecrack.exe (ExitCode: 0x0)
17:25:41 PM - [FBASetProgressText] Installing System Security...
17:26:36 PM - [FBAInstallSecurity] Successfully set security!
17:26:36 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBASEC.DLL,
FBAInstallSecurityPhase1
17:26:37 PM - [FBASetProgressText] Registering Components...
FBAResetSetup
17:50:37 PM - [FBASetProgressText] Replacing System Hives...
17:50:38 PM - [FBASetProgressText] Resetting Setup Flag...
17:51:15 PM - [FBAFlushFilesToDisk] FlushFileBuffers(C:\) succeeded!
17:51:16 PM - [FBADoReboot] Sleeping...
17:51:26 PM - [FBADoReboot] Exiting process...
17:52:30 PM - ConfigureEwf() Start.
17:52:30 PM - Getting EWF config parameters from registry.
17:52:30 PM - Non El Torito disk configuration.
17:52:31 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.
17:52:31 PM - Protected Volume Config #0 :
17:52:31 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.
17:52:31 PM - Enable= Disabled, Optimize= 0, LazyWrite= N.
17:52:31 PM - Found 1 Hard Disks.
17:52:32 PM - Disk #0 layout info:
17:52:32 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001f30c200, type= 7
17:52:32 PM - Can't create EWF partition size = 0x000000000000fc00 on
disk# 0.
17:52:32 PM - Failed to create EWF partition.
17:52:33 PM - ConfigureEwf() End, status = 0x80070057.
17:52:34 PM - [CallEntryPointThread] C:\WINDOWS\system32\ewfdll.dll,
ConfigureEwf
17:52:34 PM - [FBASetProgressText] Resetting Setup Flag...
17:53:58 PM - [FBADoReboot] Sleeping...
17:54:08 PM - [FBADoReboot] Rebooting system...
14:37:35 PM - ConfigureEwf() Start.
14:37:35 PM - Getting EWF config parameters from registry.
14:37:35 PM - Non El Torito disk configuration.
14:37:36 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.
14:37:36 PM - Protected Volume Config #0 :
14:37:36 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.
14:37:36 PM - Enable= Disabled, Optimize= 0, LazyWrite= N.
14:37:36 PM - Found 1 Hard Disks.

14:37:36 PM - Disk #0 layout info:
14:37:37 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001f30c200, type= 7
14:37:37 PM - Can't create EWF partition size = 0x000000000000fc00 on
disk# 0.
14:37:37 PM - Failed to create EWF partition.
14:37:37 PM - ConfigureEwf() End, status = 0x80070057.

 

[richard]

I'm pretty sure the only way to use EWF without a partition is to use the
EWF RAM Registry Mode which stores the information in the registry instead
of on a partition. I think if you are using any other mode you must have
some extra space on your drive that is not partitioned so XPe can put it's
info there.

This is available from XPEFiles.com. It's built in to the new Feature Pack.

Richard

FBALOG.txt File is as pasted below, Its showing that can't create EWF
Partition.
Failed to create EWF Partition.

Copying the last segment of FBA Process from the FBALOG file which is
concern with EWF Configuration.


Wednesday, August 30, 2006

17:24:59 PM - [FBASetProgressText] Setting PNP Flag...
17:25:27 PM - [FBAApplySecurityStringToRegKey] RegSetKeySecurity Failed!
Error: 0x6
17:25:27 PM - [FBAReplaceSecurityInRegistry]
FBAApplySecurityStringToRegKey(009) #1 Failed!
17:25:39 PM - [FBASetProgressText] Initializing...
17:25:39 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBALIB.DLL,
FBAInitialize
17:25:39 PM - [FBASetProgressText] Setting SystemPrefix...
17:25:40 PM - [FBASetProductKey] Evaluation product key
17:25:40 PM - [FBASetProgressText] Initializing User Profiles...
17:25:40 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBALIB.DLL, FBAStep1
17:25:41 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBALIB.DLL,
FBASetSetupInfo
17:25:41 PM - [FBASetProgressText] Installing Components...
17:25:41 PM - [FBALaunch] C:\WINDOWS\Temp\xpecrack.exe (ExitCode: 0x0)
17:25:41 PM - [FBASetProgressText] Installing System Security...
17:26:36 PM - [FBAInstallSecurity] Successfully set security!
17:26:36 PM - [CallEntryPointThread] C:\WINDOWS\FBA\FBASEC.DLL,
FBAInstallSecurityPhase1
17:26:37 PM - [FBASetProgressText] Registering Components...
FBAResetSetup
17:50:37 PM - [FBASetProgressText] Replacing System Hives...
17:50:38 PM - [FBASetProgressText] Resetting Setup Flag...
17:51:15 PM - [FBAFlushFilesToDisk] FlushFileBuffers(C:\) succeeded!
17:51:16 PM - [FBADoReboot] Sleeping...
17:51:26 PM - [FBADoReboot] Exiting process...
17:52:30 PM - ConfigureEwf() Start.
17:52:30 PM - Getting EWF config parameters from registry.
17:52:30 PM - Non El Torito disk configuration.
17:52:31 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.
17:52:31 PM - Protected Volume Config #0 :
17:52:31 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.
17:52:31 PM - Enable= Disabled, Optimize= 0, LazyWrite= N.
17:52:31 PM - Found 1 Hard Disks.
17:52:32 PM - Disk #0 layout info:
17:52:32 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001f30c200, type= 7
17:52:32 PM - Can't create EWF partition size = 0x000000000000fc00 on
disk# 0.
17:52:32 PM - Failed to create EWF partition.
17:52:33 PM - ConfigureEwf() End, status = 0x80070057.
17:52:34 PM - [CallEntryPointThread] C:\WINDOWS\system32\ewfdll.dll,
ConfigureEwf
17:52:34 PM - [FBASetProgressText] Resetting Setup Flag...
17:53:58 PM - [FBADoReboot] Sleeping...
17:54:08 PM - [FBADoReboot] Rebooting system...
14:37:35 PM - ConfigureEwf() Start.
14:37:35 PM - Getting EWF config parameters from registry.
14:37:35 PM - Non El Torito disk configuration.
14:37:36 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.
14:37:36 PM - Protected Volume Config #0 :
14:37:36 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.
14:37:36 PM - Enable= Disabled, Optimize= 0, LazyWrite= N.
14:37:36 PM - Found 1 Hard Disks.

14:37:36 PM - Disk #0 layout info:
14:37:37 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001f30c200, type= 7
14:37:37 PM - Can't create EWF partition size = 0x000000000000fc00 on
disk# 0.
14:37:37 PM - Failed to create EWF partition.
14:37:37 PM - ConfigureEwf() End, status = 0x80070057.

 

[Sean Liming \(eMVP\)]

You still need partition space so a small 64KB partition can be created fro
EWF RAM mode. Parition the drive so there is 500 MB for OS and enough empty
space for EWF volume to be created. The EWF Parition Size is for use with
Disk Overlay. Otherwise you have to use EWF RAM-REG, which can be set using
FP2007.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit