It almost sounds like you are using an older version of EWF that doesn't
support commit for registry configured RAM overlays, however the flag for
registry configured enabled / disabled setting was added in the same release
that added commit support (as I remember it) . There have been a few QFE's
for EWF. Are you sure you are using the latest?
You are correct that if ewfmgr does not show a boot command then it is
registry configured, and it is not using an EWF configuration partition.
Another way to tell is to type ewfmgr with no parameters. If it says
"Unable to find an Ewf volume.", either it is configured from the registry
or it isn't running at all. By the way, ewfmgr will show boot commands on
registry configurations on its next release.
All ewfmgr boot commands are performed on the next restart, which means a
proper shutdown may be required (definitely required for registry configured
RAM overlays). Perhaps your runtime is somehow configured such that it
doesn't go through the proper shutdown sequence.
David D said:
Trying either method
ewfmgr c: -commitanddisable
xpepm -Restart
or
regedit to set 0 to EWF enabled state.
ewfmgr c: -commit
xpepm -restart
Will result in the EWF staying as enabled. Once enabled I can not do
anything to get it to be disabled again.
Question:
On your system, if you type in ewfmgr c:, will you not have a statement
showing the if the EWF will be enabled or disabled on the next boot?
Mine does not show that and I recall that back when I had things working it
would.
does
it
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protecte
d\Volume0\Enabled
0 - Disabled
1 - Enabled
Regards,
Slobodan
message
Maybe I have done something wrong in the setup:
Here is what I have in TD:
components added:
Enable Auto LAyout setting 1.1 R5
It looks like i may have added the following into the
component
but
is
currently disabled:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed\Volume0]
"VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000000
"Type"=dword:00000001
Enhanced Write Filter - Hotfix Q823025 Version 2.0.1901.2
R1901
Settings are described in Slobodan's guide
ewfdll.dll and ewfinit.dll are disabled
FBA DLL/Com registration is disabled
EWF manager console application Version 5.1.2600.1106
R1507
EWF NTLDR Version 5.1.2600.1106 R1507
EWF Ram Registery based on Hotfix Q23025
Up at the top in Extra registry settings for the project I
have
the
following:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed\Volume0]
"VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"Enabled"=dword:00000000
"Type"=dword:00000001
Looking at my XPe image, IN the registry I have:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protect
ed\Volume0]
[ab] (Default) Reg_SZ (Value not set)
[ab] ArcName REG_SZ multi(0)disk(0)rdisk(0)partition(1)
[011110] Enabled REG_DWORD (0)
[011110] Type REG_DWORD (1)
[ab] VolumeID {1EA414D1-6760-4625-8CBE-4F9F85A48E15}
Maybe a little better understanding on how the EWF works will
help
me.
How does XPe know that the EWF is disabled on the next boot?
If
there
is
no
extra partition to keep this info, where does XP store this
info
on
the
CF
and how with this method?
David
If you are using my approach then only one value in registry
will
tell
EWF
that it should be enabled or disabled during the boot.
If commit option is working then commitanddisable must work.
If
commitanddisable is not wokring you always have an
option
