none
EWF disable/deactivate problem RRS feed

  • Question

  • Hi,

    I am trying to figure out how HORM works. I have created an image where EWF exists.

    In the preliminary scenario, I have no problem making changes to the FS.

    I then activate HORM:

    1. ewfmgr c: -enable

    2. ewfmgr c: -activatehorm

    3. shutdown /r /t 0

    This works fine. Changes made to the FS are not retained afteer reboot nor after shutdown. i.e., new files created are deleted and changes to msconfig reset as well.

    I then wish to deactivate the HORM in order to make changes (the scenario where the we'd like to service a device later on).

    1. ewfmgr c: -deactivatehorm

    2. ewfmgr c: -disable

    3. shutdown /r /t 0

    Once Windows loads, I am still unable to make changes to the FS. It is acting as if the filter is still active even though when I run "ewfmgr" it states deactive mode.

    I have tried also to use the /h flag for shutdown but we do not have the hibernation option in the image apparently - does that matter?

    Thanks a bunch,

    kw

    Thursday, May 3, 2012 3:12 PM

Answers

  • In this particular case it is not HORM that is preventing you from making any changes but it is the EWF writefilter. And I guess the EWF writefilter is configured in RAMREG mode on your WES7 target machine.

    1. To check the state of EWF writefilter use the command "ewfmgr /all"

    2. To disable EWF (RAMREG mode) use the command "ewfmgr c: -commitanddisable"

    Let me know if this resolved your problem.

    Tuesday, May 8, 2012 10:41 PM

All replies

  • In this particular case it is not HORM that is preventing you from making any changes but it is the EWF writefilter. And I guess the EWF writefilter is configured in RAMREG mode on your WES7 target machine.

    1. To check the state of EWF writefilter use the command "ewfmgr /all"

    2. To disable EWF (RAMREG mode) use the command "ewfmgr c: -commitanddisable"

    Let me know if this resolved your problem.

    Tuesday, May 8, 2012 10:41 PM
  • EWF with HORM is two things in one. You have EWF which prevents rights from occuring, and there is HORM, which allows the system to boot to the same hibersys.fil over and over. What your are seeing is EWF at work.

    My book has some examples that cover EWF and HORM http://www.annabooks.com/Book_PGWES7.html

    If you want HORM specific, you have to put the system into hibernation: shutdown /h /t 0.

    -Sean


    www.sjjmicro.com / www.seanliming.com / www.annabooks.com, Book Author - Pro Guide to WES 7, XP Embedded Advanced, Pro Guide to POS for .NET

    Wednesday, May 9, 2012 1:53 AM
    Moderator
  • Thanks,

    I now understand the issue:

    1. I had to enable hibernation in my image (didn't know that and that's why my attempts to shutdown with "/h" did not work). and then could understand the true meaning of HORM.

    2. the commitanddisable did do the trick for letting me again make changes in the machine with the EWF.

    Cheers

    Wednesday, May 9, 2012 7:12 AM
  • Thanks,

    I have already ordered the book - people say it is most helpful.

    Wednesday, May 9, 2012 7:13 AM
  • Hi there! :-)

    Well you faced and asked exactly the same question I wanted to ask for the same issue I was facing!

    I am going to try out commitanddisable.

    One query here, though, are ewfmgr and horm totally independent of each other? Or are either or both of them dependent on the other?

    thanks

    Neeraj

    Saturday, August 31, 2013 9:45 AM
  • HORM is based on the combination of EWF and ACPI hibernation. ewfmgr.exe is a utility that controls the state of EWF and can enable and disable HORM. Online documentation covers this.


    www.annabooks.com / www.seanliming.com / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Saturday, August 31, 2013 4:36 PM
    Moderator