Problem with EWF Ram Registry component

[Nigel Walker]

I've downloaded this component but can't find an entry for
ProtectedPartitionArcName. I tried building a system without and it all
seems to work except that I can enable EWP once, but I can never disable it
again. I'm not sure how you add registry data to the component builder
because the option is greyed out when I tried to add it.

Nigel.

 

[Slobodan Brcin \(eMVP\)]

Hi Nigel,

My component?
You don't need to change ARC path since it is working.
-disable command do not work with reg RAM EWF. Use -commitanddisable command instead.

Regards,
Slobodan

PS:
Do not use it on SP2

 

[Nigel Walker]

Thanks for the quick reply, Slobodan.

When I try commitanddisable I get the message "Failed setting protected
volume cofiguration with error 87. Then when I reboot the EWF is still
enabled. I'm using SP1.

Regards,
Nigel.

 

[KM]

Nigel,

Could it happen that you have the EWF Config volume on target?
If you do, delete it.

 

[Nigel Walker]

Hi KM,

I'm at home right now so can't check it. Do you mean EWF Config volume as a
component in Target Designer? Difficult to work 'blind'!

Regards,
Nigel.

 

[KM]

Nigel,

In case you accidentally used (did not disable) the registration of Enhanced Write Filter component in TD. On target it would have
created EWF Config partition (EWF Volume) that stores EWF information.
If it is the case, it may be the reason for the failure you saw with EWF RAM Reg.

You can delete it with "etprep /delete" or with fdisk or diskpart tool.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnxpesp1/html/ewf_winxp.asp

 

[Nigel Walker]

KM,

The target disk is a removable CF so only has the one partition, so I assume
it would be impossible for another partition to be created on it?

Regards,
Nigel.

 

[KM]

Nigel,

Oh, that is a good piece of information.
Yes, you are right. It won't create EWF Config partition anyway. And that may be the reason for failure if EWF RAM Reg was not set
up properly.

How do you know that you enabled EWF? How your FBALog.txt looks like? Any EWF error?
What you see if you type "ewfmgr" and "ewfmgr c:" ?
Did you remove (disable) the "Enhanced Write Filter" component resource (FBA D::?COM Registration) in your Configuration?
Did you add [...\Services\EWF\Parameters] registry entries?

 

[Nigel Walker]

KM,

Thanks for the info, I am home right now, but I will try your suggestions
when I get back to work tomorrow.

Regards,
Nigel.

Nigel,

Oh, that is a good piece of information.
Yes, you are right. It won't create EWF Config partition anyway. And that
may be the reason for failure if EWF RAM Reg was not set
up properly.

How do you know that you enabled EWF? How your FBALog.txt looks like? Any
EWF error?
What you see if you type "ewfmgr" and "ewfmgr c:" ?
Did you remove (disable) the "Enhanced Write Filter" component resource
(FBA D::?COM Registration) in your Configuration?
Did you add [...\Services\EWF\Parameters] registry entries?

--
Regards,
KM, BSquare Corp.

KM,

The target disk is a removable CF so only has the one partition, so I
assume
it would be impossible for another partition to be created on it?

Regards,
Nigel.

 

[Richard]

"Enhanced Write Filter" component resource is in your TD Config then it will
cause problems like your seeing with RAM EWF.

 

[Nigel Walker]

What components exactly should and shouldn't be in my config then?

Regards,
Nigel.

 

[Slobodan Brcin \(eMVP\)]

Hi Nigel,

If you are using my component then remove "Enhanced Write Filter" component.
If you are configuring it manually then please read doc files that I provided or from SP2 product documentation. (It is documented
there)

Basically it is all registry related.

Regards,
Slobodan

 

[Nigel Walker]

Still having problems.

I deleted the "Enhanced Write Filter" component including the two hot fixes.

The EWF related components are now have in TD are:

EWF RAM Registry - Based on hotfix Q823025
EWF NTLDR
EWF Manager Console application
Arcom Enhanced Write Filter Shortcuts - This is just a program supplied by
the board vendor which generates calls to the EWF Manager. It just has one
file associated with it - ewf.cmd and no registry data.

When I run ewfmgr I can enable EWF and after rebooting and asking for the
EWF status, it confirms that it is enabled. The board's behaviour confirms
this too. But when I try "efwmgr c: -disable" I get that error 87 still.

What can I look at now?

Regards,
Nigel.

 

[Slobodan Brcin \(eMVP\)]

Hi Nigel,

I thought that we clarified that "-disable" command will not work, and that it should not work?

1. Try whether ewfmgr C: -commit comand return error.
2. Try whether ewfmgr C: -commitanddisable comaand return error.

In case that 1 works you can disable EWF by changing value in registry and commiting this change.

Regards,
Slobodan

 

[Nigel Walker]

Hi Slobodan,

Apologies for not paying enough attention! My excuse is that this is all new
to me and there is a lot to take in.

Well it all works as expected now, both commands you mentioned below work
without error.

Thanks for sticking with me, and thanks to the others for their helpful
remarks.

Regards,
Nigel.

 

[Richard]

He still needs the hot fixes in there for your component doesn't he?

EWF RAM Registry - Based on hotfix Q823025
EWF NTLDR
EWF Manager Console application

 

[Slobodan Brcin \(eMVP\)]

Hi Richard,

He still needs the hot fixes in there for your component doesn't he?

Actually he need two hotfixes if he don't want so see file missing warning in TD. (Second one is EWF API DLL)

EWF NTLDR
EWF Manager Console application

These two are not required for correct work and usage of EWF.
For RAM EWF usage in my opinion it is better to use regular ntldr.

Regards,
Slobodan