EWF RAM reg mode and the Registry Filter

  • Thread starter Thread starter jbcseri
  • Start date Start date
J

jbcseri

Documentation states that when EWF is enabled in RAM reg mode, the
ewfmgr disable command won't work and instead commitanddisable must be
used to disable EWF, which makes sense. I was thinking that I could
use the registry filter in order to get the disable command to work
and avoid having to commit the entire overlay just to disable EWF, so
in the registry filter settings, I unchecked both check boxes and
built in the following registry data:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Regfilter
\Parameters\MonitoredKeys\0]
"ClassKey"="HKLM"
"FileNameForSaving"="EWFstate.rgf"
"RelativeKeyName"="System\CurrentControlSet\Services\EWF\Parameters
\Protected\Volume0"

When EWF is enabled in RAM reg mode and I issue a disable command, I
noticed that the "Enabled" value under the relative key name above
changes to "0", and I thought that the registry filter would make it
persist between boots, but it doesn't. Now I am wondering why it
doesn't work.

I suppose that a workaround to avoid committing unwanted overlay data
would be to reboot the system to clear the overlay and then issue a
commitanddisable command, which would require another reboot. I guess
I'm trying to avoid having to reboot the system twice in a row. As far
as I can tell, in RAM reg mode EWF information is kept under the
relative key name above, but that key cannot be used in the registry
filter. Does anyone know why?
 
Please take a look at my latest post in the thread "FBWF and Registry Filter (Changing IP Address)" below. It may explain your issue
as well.

Basically the RegFilter is loading after the EWF (this is an obvious fact). After the "disable" command was issued and the target
device was rebooted, EWF reads the Enabled flag of the specified Parameters\Protected\Volume0 branch at the boot time and it is
still "1". Then the RegFilter will overwrite the value during the boot to "0" but it will already have no affect on the EWF state.

Although I would suspect that the actual value you see with regedit after reboot for the Enabled flag should be "0" (although,
again, it acts like it is "1"). May be interesting if you could confirm that.
 
Back
Top