locked
How to change the protected partition with EWF-RAM mode ? RRS feed

  • Question

  • I have several partitions on a system.
    It's possible to boot from 2 diffrent partitions.

    The 2nd partition is F: and I want to enable EWF RAM mode on this partition.
    I guess I've not disabled the FBA DLL/COM Registration of the Enhanced Write Filter component, and now when I type "ewfmgr f:" it returns an error, whereas "ewfmgr c:" is OK.

    How is it possible to change the protected partition without re-deploying the image ?

    Thanks for your help.

    Gastr
    Monday, October 26, 2009 7:21 PM

All replies

    1. What is the error reported ?
    2. What is the disk number / partition number for F:
    3. Please share contents of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EWF\FBA

    You need to ensure the contents of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EWF\FBA  match the partitions you want to protect and re-run ewfdll.dll , which will recreate the EWF partition

    C:\windows\system32>rundll32.exe ewfdll.dll, ConfigureEwf


    Srikanth Kamath [MSFT]
    Monday, October 26, 2009 7:29 PM
  • Hi,

    Thank you for the answer.

    2.  F is the 2nd partition on disk 0
    3.  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EWF\FBA :
    "OVSize"=dword:00000000
    "OVLevel"=dword:00000001
    "PVConfigs"=dword:00000001
    "EwfEnable"=hex(7):30,00,00,00,00,00
    "EnableLazyWrite"=hex(7):30,00,00,00,00,00
    "PVDisk"=hex(7):30,00,00,00,00,00
    "PVPart"=hex(7):31,00,00,00,00,00
    "PVOptimize"=hex(7):30,00,00,00,00,00
    "PVType"=hex(7):31,00,00,00,00,00

    Which key has to be changed ?
    I suppose it's "PVPart", but what value for the 2nd partition ?

    Thanks a lot again.
    Monday, October 26, 2009 9:03 PM
  • Sorry, I guess I have only to specify '2' for 'PVPart'.
    Then, I will execute rundll32...

    I'll get back to you asap for the result.
    Monday, October 26, 2009 9:19 PM
  • PVConfigs should be set to 2 to indicate that you intend to protect two partitions. PVDisk and PVPart are both REG_MULTI_SZ values. Since you intend to protect {disknumber, partnumber} = {0, 1} and {0, 2} , specify 0 0 for PVDisk and 1 2 for PVPart. Edit using regedit and specify one per line.
    Srikanth Kamath [MSFT]
    Tuesday, October 27, 2009 4:40 AM
  • Thank you for your help Srikanth !

    In fact, I just want to protect partition 2, so I follow this procedure :
    - modifiy PVPart from 1 to 2
    - run : rundll32.exe ewfdll.dll ConfigureEwf

    And it's OK !
    Tuesday, October 27, 2009 8:12 AM