How to clone an XPE system using EWF?

[Scott Kelly]

Now that I have my XPE system running nicely with EWF, I wish to clone it to
test on other systems. My hard drive is:
10.06gig
Partition 1: 1gig NTFS for OS - protected by EWF
Partition 2: 7gig NTFS for my apps data
Partition 3: 1gig for EWF volume

In the past I had one simple NTFS partition, so to clone it I simply
formatted my new drive and copied over the files.

So now, I took a drive and partitioned it like:
Partition 1: 1gig NTFS - set active
Partition 2: 7gig NTFS
the rest was left as is.

I then copied all the files from my source disk partion 1 to my destination.
I did the same thing with partition 2.

I rebooted and all seemed well. But when I ran ewfmgr...

When I run ewfmgr, I get the message:
Unable to find EWF volume

When I run "ewfmgr c:" I get:
Failed getting protected volume configuration with error 1.

How do I clone my EWF enabled hard drive?

Thanks,
Scott

 

[Scott Kelly]

I did more testing and found that if I use Norton Ghost to do a disk to disk
copy, I get a little further.

Basically if I clone the drive with Norton, I then can run ewfmgr, and it
reports that global data information and then:
Protect Volumes
Device Name ""

Instead of the normal:
Protect Volumes
Device Name "\Device\HarddiskVolume1" [C:]

I checked and the EWF partition is there. When I run "ewfmgr c:" I still
get:
Failed getting protected volume configuration with error 1.

Any thoughts on how to clone this guy?

Scott

 

[Scott Kelly]

Jeff...that would be great.

I just found that if I run Ghost with the command line option of "-IR" that
it will work.

I am tried another test where instead of letting FBA use unpartitioned space
for the EWF volumn, I was having it use an extended volume. I hoped that
when Ghost does a copy of the disk - it will see the extended partition and
copy it in-tact too.

That didn't work either.

Scott

We have come up w/ a process for cloning EWF w/ ghost.

It has to do w/ a trick to turn off EWF, clone it, then
turn it back on. I'll scrounge up our whitepaper that
describes it and re-post.

-jeff

-----Original Message-----
I did more testing and found that if I use Norton Ghost to do a disk to disk
copy, I get a little further.

Basically if I clone the drive with Norton, I then can run ewfmgr, and it
reports that global data information and then:
Protect Volumes
Device Name ""

Instead of the normal:
Protect Volumes
Device Name "\Device\HarddiskVolume1" [C:]

I checked and the EWF partition is there. When I run "ewfmgr c:" I still
get:
Failed getting protected volume configuration with error 1.

Any thoughts on how to clone this guy?

Scott


.

 

[Jeff Arnett \(eMVP\)]

Scott,

Are you still interested in the EWF cloning tweak we came
up with or are you happy w/ the -IR option.

What are the downsides to raw copy? How long does it take
etc.

If you are still interested in our solution I need to
clear some internal hurdles first. But it is basically a
way for the system to re-create all the EWF stuff
(volume) when it needs to. So we basically delete the EWF
volume (do our tweak) and capture an image w/ ghost. When
the image is copied to a new target (or recovered) the
system notices that EWF isn't there and sets it up. The
beauty is that ghost doesn't have to know or care about
EWF.

-jeff

-----Original Message-----
Jeff...that would be great.

I just found that if I run Ghost with the command line option of "-IR" that
it will work.

I am tried another test where instead of letting FBA use unpartitioned space
for the EWF volumn, I was having it use an extended volume. I hoped that
when Ghost does a copy of the disk - it will see the extended partition and
copy it in-tact too.

That didn't work either.

Scott

We have come up w/ a process for cloning EWF w/ ghost.

It has to do w/ a trick to turn off EWF, clone it, then
turn it back on. I'll scrounge up our whitepaper that
describes it and re-post.

-jeff

-----Original Message-----
I did more testing and found that if I use Norton

Ghost
to do a disk to disk

copy, I get a little further.

Basically if I clone the drive with Norton, I then can run ewfmgr, and it
reports that global data information and then:
Protect Volumes
Device Name ""

Instead of the normal:
Protect Volumes
Device Name "\Device\HarddiskVolume1" [C:]

I checked and the EWF partition is there. When I run "ewfmgr c:" I still
get:
Failed getting protected volume configuration with error 1.

Any thoughts on how to clone this guy?

Scott


.

.