EWF

  • Thread starter Thread starter Paul
  • Start date Start date
P

Paul

Hello All

We just had an image built post FBA, but it seems though the EWFMGR command
is recognised we do not have a protected partition. Is it possible to go
through the registry or a command line and reset the protected partition?

I thought this was possible but have not found any documentation on how to
do this.

If anyone knows would appreciate it as I really do not want to go through
FBA again.

Cheers

Paul
 
I do have an fbalog, I will post it here, it does have the EWF setup and it
looks like there is a problem at the end.

Once i get the kids to bed I will post it.

Cheers KM

Paul!

KM said:
Paul,

You can use etprep /delete command to erase the EWF Config partition
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht
ml/cdtbsEtprepUsage.asp).
Or delete it with diskpart tool.

Check you FBALog.txt for EWF error. You will see there if it is created on
Click to expand...
your target (the same target where you ran FBA).
 
Here is the log of the EWF in FBA

16:38:51 PM - [FBADoReboot] Rebooting system...
16:40:03 PM - ConfigureEwf() Start.

16:40:04 PM - Getting EWF config parameters from registry.

16:40:04 PM - Non El Torito disk configuration.

16:40:04 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.

16:40:05 PM - Protected Volume Config #0 :

16:40:05 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.

16:40:05 PM - Enable= Enabled, Optimize= 0, LazyWrite= N.

16:40:05 PM - Found 1 Hard Disks.

16:40:05 PM - Disk #0 layout info:

16:40:05 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001e544200, type= 7

16:40:05 PM - FREE partition,start=0x000000001e54c000,
len=0x0000000000372000, type= 0

16:40:05 PM - Allocating EWF in PRIMARY partition,
start=0x000000001e54c000, len=0x000000000000fc00.

16:40:05 PM - Created EWF partition on Disk = 0, partition = 2,size =
0x000000000000fc00 .

16:40:06 PM - ewfOpen.

16:40:06 PM - ewfOpen returned invalid file handle.

16:40:06 PM - Deleting EWF Partition #0, disk#=0, type=69

16:40:07 PM - ConfigureEwf() End, status = 0x2.

Cheers

Paul
KM said:
Paul,

You can use etprep /delete command to erase the EWF Config partition
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht
ml/cdtbsEtprepUsage.asp).
Or delete it with diskpart tool.

Check you FBALog.txt for EWF error. You will see there if it is created on
Click to expand...
your target (the same target where you ran FBA).
 
Paul,

EWF partition did not get created on your image.

For testing purposes, before you run FBA on your run time, make sure that
you:
- Have 8M free unpartitioned space on the hard disk (you seem to only
have ~ 3Mb). Even though it is only 32/64Kb is required to create EWF
partition, 8M requireemtn still seems to be there for EWF.
- You don't have EWF partition on your hard disk from previous XPe
installations . You can see it with 3rd partyt disk management tools or with
MS diskpart. Run etprep /delete to remove the partition.

Or, you can use RAM based EWF without creation of the EWF Config partition
at all.
Download Slobodan's component:
http://www.xpefiles.com/a_file.cfm?custid=Components&fileid=ramewf.zip&groupName=Other.
Read docs from the zip to get mroe info.

KM
Here is the log of the EWF in FBA

16:38:51 PM - [FBADoReboot] Rebooting system...
16:40:03 PM - ConfigureEwf() Start.

16:40:04 PM - Getting EWF config parameters from registry.

16:40:04 PM - Non El Torito disk configuration.

16:40:04 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.

16:40:05 PM - Protected Volume Config #0 :

16:40:05 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.

16:40:05 PM - Enable= Enabled, Optimize= 0, LazyWrite= N.

16:40:05 PM - Found 1 Hard Disks.

16:40:05 PM - Disk #0 layout info:

16:40:05 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001e544200, type= 7

16:40:05 PM - FREE partition,start=0x000000001e54c000,
len=0x0000000000372000, type= 0

16:40:05 PM - Allocating EWF in PRIMARY partition,
start=0x000000001e54c000, len=0x000000000000fc00.

16:40:05 PM - Created EWF partition on Disk = 0, partition = 2,size =
0x000000000000fc00 .

16:40:06 PM - ewfOpen.

16:40:06 PM - ewfOpen returned invalid file handle.

16:40:06 PM - Deleting EWF Partition #0, disk#=0, type=69

16:40:07 PM - ConfigureEwf() End, status = 0x2.

Cheers

Paul
KM said:
Paul,

You can use etprep /delete command to erase the EWF Config partition
Click to expand...
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht
ml/cdtbsEtprepUsage.asp).
Or delete it with diskpart tool.

Check you FBALog.txt for EWF error. You will see there if it is created
Click to expand...
on
your target (the same target where you ran FBA). how
to
Click to expand...
Click to expand...
 
Hi Paul

Like KM said, your EWF partition was not created during FBA. This can be
for several reasons. What is the partitioning structure of your disk like?

EWF will attempt to create the EWF Volume during FBA either:
-Immediately after a Primary partition,
Or
-Within empty space in an Extended partition.

EWF will fail to create the EWF volume if either of these conditions are not
met. Usually it's best to keep your partitioning scheme simple. Use all
Primary partitions, if possible.

It's also important to delete any preexisting EWF Volume on the system. You
can use etprep, like KM said. You can also boot WinPE on your device and
use diskpart. Simply boot the first disk of the Windows Embedded Studios
Tools, and WinPE will start.

Then, you can run diskpart at the command line and delete the EWF Volume.
You can identify the EWF Volume by size. It is typically 64KB for RAM
overlays.

Hope this helps
Dan


--
This posting is provided "AS IS" with no warranties, and confers no rights

Paul said:
Here is the log of the EWF in FBA

16:38:51 PM - [FBADoReboot] Rebooting system...
16:40:03 PM - ConfigureEwf() Start.

16:40:04 PM - Getting EWF config parameters from registry.

16:40:04 PM - Non El Torito disk configuration.

16:40:04 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.

16:40:05 PM - Protected Volume Config #0 :

16:40:05 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.

16:40:05 PM - Enable= Enabled, Optimize= 0, LazyWrite= N.

16:40:05 PM - Found 1 Hard Disks.

16:40:05 PM - Disk #0 layout info:

16:40:05 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001e544200, type= 7

16:40:05 PM - FREE partition,start=0x000000001e54c000,
len=0x0000000000372000, type= 0

16:40:05 PM - Allocating EWF in PRIMARY partition,
start=0x000000001e54c000, len=0x000000000000fc00.

16:40:05 PM - Created EWF partition on Disk = 0, partition = 2,size =
0x000000000000fc00 .

16:40:06 PM - ewfOpen.

16:40:06 PM - ewfOpen returned invalid file handle.

16:40:06 PM - Deleting EWF Partition #0, disk#=0, type=69

16:40:07 PM - ConfigureEwf() End, status = 0x2.

Cheers

Paul
KM said:
Paul,

You can use etprep /delete command to erase the EWF Config partition
Click to expand...
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht
ml/cdtbsEtprepUsage.asp).
Or delete it with diskpart tool.

Check you FBALog.txt for EWF error. You will see there if it is created
Click to expand...
on
your target (the same target where you ran FBA). how
to
Click to expand...
Click to expand...
 
We are not sure why it wasn't being created, however after talking with MS
for a couple hours, we took out some components ,adding them back, shook
real hard and presto we are back to having EWF.

I think that the main issue was the ewf from previous builds not being
deleted, which shouldn't have happened as we were reformatting the entire
disk before running FBA. Oh well we are good to go on this image and our
customer is happy again, which makes me happy!

Thanks Gents!

Cheers

Paul

Daniel Simpson (MS) said:
Hi Paul

Like KM said, your EWF partition was not created during FBA. This can be
for several reasons. What is the partitioning structure of your disk like?

EWF will attempt to create the EWF Volume during FBA either:
-Immediately after a Primary partition,
Or
-Within empty space in an Extended partition.

EWF will fail to create the EWF volume if either of these conditions are not
met. Usually it's best to keep your partitioning scheme simple. Use all
Primary partitions, if possible.

It's also important to delete any preexisting EWF Volume on the system. You
can use etprep, like KM said. You can also boot WinPE on your device and
use diskpart. Simply boot the first disk of the Windows Embedded Studios
Tools, and WinPE will start.

Then, you can run diskpart at the command line and delete the EWF Volume.
You can identify the EWF Volume by size. It is typically 64KB for RAM
overlays.

Hope this helps
Dan


--
This posting is provided "AS IS" with no warranties, and confers no rights

Paul said:
Here is the log of the EWF in FBA

16:38:51 PM - [FBADoReboot] Rebooting system...
16:40:03 PM - ConfigureEwf() Start.

16:40:04 PM - Getting EWF config parameters from registry.

16:40:04 PM - Non El Torito disk configuration.

16:40:04 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.

16:40:05 PM - Protected Volume Config #0 :

16:40:05 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.

16:40:05 PM - Enable= Enabled, Optimize= 0, LazyWrite= N.

16:40:05 PM - Found 1 Hard Disks.

16:40:05 PM - Disk #0 layout info:

16:40:05 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001e544200, type= 7

16:40:05 PM - FREE partition,start=0x000000001e54c000,
len=0x0000000000372000, type= 0

16:40:05 PM - Allocating EWF in PRIMARY partition,
start=0x000000001e54c000, len=0x000000000000fc00.

16:40:05 PM - Created EWF partition on Disk = 0, partition = 2,size =
0x000000000000fc00 .

16:40:06 PM - ewfOpen.

16:40:06 PM - ewfOpen returned invalid file handle.

16:40:06 PM - Deleting EWF Partition #0, disk#=0, type=69

16:40:07 PM - ConfigureEwf() End, status = 0x2.

Cheers

Paul
KM said:
Paul,

You can use etprep /delete command to erase the EWF Config partition
Click to expand...
Click to expand...
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht created
on
your target (the same target where you ran FBA).
Click to expand...
to
go how
Click to expand...
Click to expand...
 
Hi Paul,

Key word is "reformating disk".
Reformating volumes do not delete hidden EWF volume.

You must either delete it manually or eradicate (sector to all zeroes) MBR partition table.

Regards,
Slobodan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Do have an opinion on the effectiveness of Microsoft Windows Mobile and Embedded newsgroups? Let us know!
https://www.windowsembeddedeval.com/community/newsgroups
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Paul said:
We are not sure why it wasn't being created, however after talking with MS
for a couple hours, we took out some components ,adding them back, shook
real hard and presto we are back to having EWF.

I think that the main issue was the ewf from previous builds not being
deleted, which shouldn't have happened as we were reformatting the entire
disk before running FBA. Oh well we are good to go on this image and our
customer is happy again, which makes me happy!

Thanks Gents!

Cheers

Paul

Daniel Simpson (MS) said:
Hi Paul

Like KM said, your EWF partition was not created during FBA. This can be
for several reasons. What is the partitioning structure of your disk like?

EWF will attempt to create the EWF Volume during FBA either:
-Immediately after a Primary partition,
Or
-Within empty space in an Extended partition.

EWF will fail to create the EWF volume if either of these conditions are not
met. Usually it's best to keep your partitioning scheme simple. Use all
Primary partitions, if possible.

It's also important to delete any preexisting EWF Volume on the system. You
can use etprep, like KM said. You can also boot WinPE on your device and
use diskpart. Simply boot the first disk of the Windows Embedded Studios
Tools, and WinPE will start.

Then, you can run diskpart at the command line and delete the EWF Volume.
You can identify the EWF Volume by size. It is typically 64KB for RAM
overlays.

Hope this helps
Dan


--
This posting is provided "AS IS" with no warranties, and confers no rights

Paul said:
Here is the log of the EWF in FBA

16:38:51 PM - [FBADoReboot] Rebooting system...
16:40:03 PM - ConfigureEwf() Start.

16:40:04 PM - Getting EWF config parameters from registry.

16:40:04 PM - Non El Torito disk configuration.

16:40:04 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.

16:40:05 PM - Protected Volume Config #0 :

16:40:05 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.

16:40:05 PM - Enable= Enabled, Optimize= 0, LazyWrite= N.

16:40:05 PM - Found 1 Hard Disks.

16:40:05 PM - Disk #0 layout info:

16:40:05 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001e544200, type= 7

16:40:05 PM - FREE partition,start=0x000000001e54c000,
len=0x0000000000372000, type= 0

16:40:05 PM - Allocating EWF in PRIMARY partition,
start=0x000000001e54c000, len=0x000000000000fc00.

16:40:05 PM - Created EWF partition on Disk = 0, partition = 2,size =
0x000000000000fc00 .

16:40:06 PM - ewfOpen.

16:40:06 PM - ewfOpen returned invalid file handle.

16:40:06 PM - Deleting EWF Partition #0, disk#=0, type=69

16:40:07 PM - ConfigureEwf() End, status = 0x2.

Cheers

Paul
Paul,

You can use etprep /delete command to erase the EWF Config partition
Click to expand...
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht
ml/cdtbsEtprepUsage.asp).
Or delete it with diskpart tool.

Check you FBALog.txt for EWF error. You will see there if it is
Click to expand...
created
on
your target (the same target where you ran FBA).

--
Regards,
KM, BSquare Corp.


Hello All

We just had an image built post FBA, but it seems though the EWFMGR
command
is recognised we do not have a protected partition. Is it possible
Click to expand...
to
go
through the registry or a command line and reset the protected
partition?

I thought this was possible but have not found any documentation on how
to
do this.

If anyone knows would appreciate it as I really do not want to go
through
FBA again.

Cheers

Paul
Click to expand...
Click to expand...
Click to expand...
 
Ahh, that makes sense!

Well I am not sure what we did to get it right but the post FBA has now got
EWF and customer is happy, especially as he was able to put NAV on it too so
he should be mucho prepared against the next virus attacks.

Cheers

Paul
Slobodan Brcin (eMVP) said:
Hi Paul,

Key word is "reformating disk".
Reformating volumes do not delete hidden EWF volume.

You must either delete it manually or eradicate (sector to all zeroes) MBR partition table.

Regards,
Slobodan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Do have an opinion on the effectiveness of Microsoft Windows Mobile and
Click to expand...
Embedded newsgroups? Let us know!
https://www.windowsembeddedeval.com/community/newsgroups
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We are not sure why it wasn't being created, however after talking with MS
for a couple hours, we took out some components ,adding them back, shook
real hard and presto we are back to having EWF.

I think that the main issue was the ewf from previous builds not being
deleted, which shouldn't have happened as we were reformatting the entire
disk before running FBA. Oh well we are good to go on this image and our
customer is happy again, which makes me happy!

Thanks Gents!

Cheers

Paul

Daniel Simpson (MS) said:
Hi Paul

Like KM said, your EWF partition was not created during FBA. This can be
for several reasons. What is the partitioning structure of your disk like?

EWF will attempt to create the EWF Volume during FBA either:
-Immediately after a Primary partition,
Or
-Within empty space in an Extended partition.

EWF will fail to create the EWF volume if either of these conditions
Click to expand...
are
not
met. Usually it's best to keep your partitioning scheme simple. Use all
Primary partitions, if possible.

It's also important to delete any preexisting EWF Volume on the
Click to expand...
system.
You
can use etprep, like KM said. You can also boot WinPE on your device and
use diskpart. Simply boot the first disk of the Windows Embedded Studios
Tools, and WinPE will start.

Then, you can run diskpart at the command line and delete the EWF Volume.
You can identify the EWF Volume by size. It is typically 64KB for RAM
overlays.

Hope this helps
Dan


--
This posting is provided "AS IS" with no warranties, and confers no rights

Here is the log of the EWF in FBA

16:38:51 PM - [FBADoReboot] Rebooting system...
16:40:03 PM - ConfigureEwf() Start.

16:40:04 PM - Getting EWF config parameters from registry.

16:40:04 PM - Non El Torito disk configuration.

16:40:04 PM - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes
Click to expand...
=
1.
16:40:05 PM - Protected Volume Config #0 :

16:40:05 PM - Disk= 0,Part= 1,DiskType= IDE,Type= RAM.

16:40:05 PM - Enable= Enabled, Optimize= 0, LazyWrite= N.

16:40:05 PM - Found 1 Hard Disks.

16:40:05 PM - Disk #0 layout info:

16:40:05 PM - PRIMARY partition,start=0x0000000000007e00,
len=0x000000001e544200, type= 7

16:40:05 PM - FREE partition,start=0x000000001e54c000,
len=0x0000000000372000, type= 0

16:40:05 PM - Allocating EWF in PRIMARY partition,
start=0x000000001e54c000, len=0x000000000000fc00.

16:40:05 PM - Created EWF partition on Disk = 0, partition = 2,size =
0x000000000000fc00 .

16:40:06 PM - ewfOpen.

16:40:06 PM - ewfOpen returned invalid file handle.

16:40:06 PM - Deleting EWF Partition #0, disk#=0, type=69

16:40:07 PM - ConfigureEwf() End, status = 0x2.

Cheers

Paul
Paul,

You can use etprep /delete command to erase the EWF Config partition
Click to expand...
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/ht
ml/cdtbsEtprepUsage.asp).
Or delete it with diskpart tool.

Check you FBALog.txt for EWF error. You will see there if it is created
on
your target (the same target where you ran FBA).

--
Regards,
KM, BSquare Corp.


Hello All

We just had an image built post FBA, but it seems though the EWFMGR
command
is recognised we do not have a protected partition. Is it
Click to expand...
possible
to
go
through the registry or a command line and reset the protected
partition?

I thought this was possible but have not found any documentation on
how
to
do this.

If anyone knows would appreciate it as I really do not want to go
through
FBA again.

Cheers

Paul
Click to expand...
Click to expand...
Click to expand...
 
Back
Top