EWF

[Dietmar]

Hi Slobodan,
have You ever compared the WHOLE registry with Regmon or something like
BEFORE You reboot the image for the first time with EFW and after this
reboot?
I do not understand, why there MUST be a reboot only to get EWF installed
but You can disable EWF live. Should no registry patch from OUTSIDE
overcome this? I will explore it too, with EWF to be installed AFTER the
image is build to have a clear situation.

Dietmar

 

[Dietmar]

Hi Slobodan,
I think this must work:

Host: Mikehall (Microsoft)
Q: Anybody knows how to redirect a portion of the registry to another
drive? And, of course, how to say to XPE to read from there at the boot
time?
A: Tools such as Regmon from http://www.sysinternals.com monitor changes
to the registry real-time, you could use the same techniques to monitor
changes to the registry, hive this to a file on a net share or other drive
- you will need to look at when the calibration information read back from
the registry ? - you would need to load your registry hook before the
driver loaded it's calibration data.

Host: Mikehall (Microsoft)
Q: This is my problem, I already know the registry changes that
calibration do, but I don’t know how to load this from a hive before the
ELO driver load in the boot time. Any suggestions?
A: Windows has 4 distinct load phases,

Kernel load,


Kernel Initialization (loads drivers),


Services load,


Win32 Subsystem load
Any registry load mechanism you create would need to load the registry
information before the touch driver gets loaded - perhaps a small dummy
driver might be the solution.

Dietmar

 

[Slobodan Brcin \(eMVP\)]

Hi Dietmar,

Unfortunately and obviously I could never be a good teacher since even after
countless attempts to give you what you should read to understand this and
description of how it work you still ask basically the same questions.

Facts:
1. I know everything that there is to be known about EWF.
2. I know how all related registry entries that EWF uses work. Before and
after installation.
3. I know how to make EWF work even on systems without User mode PnP and
without installation and additional boot.
4. I do not know how to make option 3 to work on different configurations
automatically.

Facts that you are confusing:
1. EWF is driver.
2. EWF is configured to be loaded by ntldr.
3. EWF is upper filter driver and it must be connected above some other
driver.
4. EWF is volume upper class filter driver (this mean that it is installed
over all volume instances that are detected by PnP)
5. Once EWF driver is initialized and connected to volume it can't be
stopped without stopping volume in case of OS volume you must reboot
computer.
6. committing, disabling, enabling, etc do not stop driver but just tell
driver itself how it should behave, nothing more nothing less. Like I
already said EWF is connected to all your volumes regardless of whether you
want to protect some volume or not, this is how thing work. Based on
registry and ewfmgr settings made certain driver instances will internally
behave as pass trough or they will overlay data.

Facts that you won't accept is that if driver is not connected to volume
that you want to protect you can't configure it trough registry or ewfmgr,
since you can't communicate with driver instance that is not there.
Fact: If you want you can forget about MS way of using class filter driver
and manually connect EWF only to existing volumes in registry that you
choose.

Thing that you need and that I do not know if possible is to make Upper
Class Filter driver to start if there are no volume registry entries entered
by PnP.
I'm very interested in this thing for other usages, but like I said many
times I do not know if this is supported by OS.

Regards,
Slobodan

 

[Slobodan Brcin \(eMVP\)]

Dietmar,

Q: Anybody knows how to redirect a portion of the registry to another
drive? And, of course, how to say to XPE to read from there at the boot
time?

This nobody knows, not even MS personel, and this solution would solve many
problems with XPe, you need only to find it.

Please read new thread from yesterday on this topic in this NG, and give us
some sugestions if you have them, we will certainly aprechiate any solutions
to this problem.
http://groups-beta.google.com/[email protected]

Second answer might work for touch screen driver, but not for boot-critical
drivers. There are more than four distinct phases and EWF is in catogory not
mentioned here. (Actualy it would be closes to kernel loda phase)

Regards,
Slobodan