Problem driving EWF with C++...

Question

Hi,

I use the commercial version of ICE with a commercial product key...

I try to drive EWF using C++ API; I start with the MSDN sample: http://msdn.microsoft.com/en-us/library/bb499289%28v=WinEmbedded.51%29.aspx

Each function starting by EwfMgrOpenOverlayStore failed with error code 3: The system cannot find the path specified.

So I can't activate low space notify: EwfMgrRegisterLowSpaceNotification.

If some one has a solution to:
 - Have a notification when memory reserved for EWF if full.
 - Made the EwfMgrOpenOverlayStore working...

Best regards,

Answer 1

If you run EWFMGR, do you get any errors?

-Sean

---

www.sjjmicro.com / www.seanliming.com / www.annabooks.com, Book Author - Pro Guide to WES 7, XP Embedded Advanced, Pro Guide to POS for .NET

Answer 2

Update : 02 dec 2011

Thanks for reply,

EWFMGR work for enabling or disabling volume protection and HORM...

I Use the ICE\Win7e with SP1 and I test with or without fix for EWF available on ice on VM and pad device.

I Build with ice a full OS + EWF

I compile the EWF MSDN samplefrom : http://msdn.microsoft.com/en-us/library/ms912855%28v=winembedded.5%29.aspx

The sample indicate that a lot of function failed :

 

Ewf API Sample

EwfMgrOpenOverlayStore failed LE = 3
?: = \\?\storage#volume#{441b619f-0ec8-11e1-92d9-806e6f6e6963}#0000000000100000#{68ebf3a0-82df-4f8a-b6d3-bd5dde13b313}


--------------------------------------------------------
-- Ewf protected volume configuration                  
--------------------------------------------------------

TYPE      : EWF_RAM_REG
STATE     : EWF_DISABLED
BOOT CMD  : EWF_NO_CMD     Param1 = 0  Param2 = 0

0000000000000000000000000000000000000000000000000000000000000000

Maximum Levels   : 1
Clump Size       : 512 Bytes
Current Level    : 0
Ram Data Size    : 0 Bytes
Memory Map Size  : 0 Bytes

Device Name      : \Device\HarddiskVolume1
Volume ID        : C83A7E10000010000000000000000000
DEVC Drive:  ?



C: = \\?\storage#volume#{441b619f-0ec8-11e1-92d9-806e6f6e6963}#0000000006500000#{68ebf3a0-82df-4f8a-b6d3-bd5dde13b313}


--------------------------------------------------------
-- Ewf protected volume configuration                  
--------------------------------------------------------

TYPE      : EWF_RAM_REG
STATE     : EWF_ENABLED
BOOT CMD  : EWF_NO_CMD     Param1 = 0  Param2 = 0

0000000000000000000000000000000000000000000000000000000000000000

Maximum Levels   : 1
Clump Size       : 512 Bytes
Current Level    : 1
Ram Data Size    : 423167488 Bytes
Memory Map Size  : 126976 Bytes

Device Name      : \Device\HarddiskVolume2
Volume ID        : C83A7E10000050060000000000000000
DEVC Drive:  ?



EwfMgrSetPersistentData failed LE = 87
EwfMgrCheckpoint failed LE = 87
EwfMgrRestore failed LE = 87
EwfMgrEnable succeeded
EwfMgrDisable failed LE = 87
EwfMgrCommit failed LE = 87
EwfMgrSetLevel failed LE = 87
EwfMgrClearCommand succeeded
EwfMgrSetPersistentData failed LE = 87
EwfMgrCheckpoint failed LE = 87
EwfMgrRestore succeeded
EwfMgrEnable failed LE = 87
EwfMgrDisable succeeded
EwfMgrCommit succeeded
EwfMgrSetLevel failed LE = 87
EwfMgrClearCommand succeeded
EwfMgrOpenOverlayStore failed LE = 3
EwfMgrOpenOverlayStore failed LE = 3