none
Problem driving EWF with C++... RRS feed

  • Question

  • Hi,

    I use the commercial version of ICE with a commercial product key...

    I try to drive EWF using C++ API; I start with the MSDN sample: http://msdn.microsoft.com/en-us/library/bb499289%28v=WinEmbedded.51%29.aspx


    Each function starting by EwfMgrOpenOverlayStore failed with error code 3: The system cannot find the path specified.


    So I can't activate low space notify: EwfMgrRegisterLowSpaceNotification.


    If some one has a solution to:
     - Have a notification when memory reserved for EWF if full.
     - Made the EwfMgrOpenOverlayStore working...

    Best regards,

    Friday, November 25, 2011 6:54 AM

Answers

  • Update : 02 dec 2011

    Thanks for reply,

    EWFMGR work for enabling or disabling volume protection and HORM...

    I Use the ICE\Win7e with SP1 and I test with or without fix for EWF available on ice on VM and pad device.

    I Build with ice a full OS + EWF

    I compile the EWF MSDN samplefrom : http://msdn.microsoft.com/en-us/library/ms912855%28v=winembedded.5%29.aspx

    The sample indicate that a lot of function failed :

     

    Ewf API Sample

    EwfMgrOpenOverlayStore failed LE = 3
    ?: = \\?\storage#volume#{441b619f-0ec8-11e1-92d9-806e6f6e6963}#0000000000100000#{68ebf3a0-82df-4f8a-b6d3-bd5dde13b313}


    --------------------------------------------------------
    -- Ewf protected volume configuration                  
    --------------------------------------------------------

    TYPE      : EWF_RAM_REG
    STATE     : EWF_DISABLED
    BOOT CMD  : EWF_NO_CMD     Param1 = 0  Param2 = 0

    0000000000000000000000000000000000000000000000000000000000000000

    Maximum Levels   : 1
    Clump Size       : 512 Bytes
    Current Level    : 0
    Ram Data Size    : 0 Bytes
    Memory Map Size  : 0 Bytes

    Device Name      : \Device\HarddiskVolume1
    Volume ID        : C83A7E10000010000000000000000000
    DEVC Drive:  ?



    C: = \\?\storage#volume#{441b619f-0ec8-11e1-92d9-806e6f6e6963}#0000000006500000#{68ebf3a0-82df-4f8a-b6d3-bd5dde13b313}


    --------------------------------------------------------
    -- Ewf protected volume configuration                  
    --------------------------------------------------------

    TYPE      : EWF_RAM_REG
    STATE     : EWF_ENABLED
    BOOT CMD  : EWF_NO_CMD     Param1 = 0  Param2 = 0

    0000000000000000000000000000000000000000000000000000000000000000

    Maximum Levels   : 1
    Clump Size       : 512 Bytes
    Current Level    : 1
    Ram Data Size    : 423167488 Bytes
    Memory Map Size  : 126976 Bytes

    Device Name      : \Device\HarddiskVolume2
    Volume ID        : C83A7E10000050060000000000000000
    DEVC Drive:  ?



    EwfMgrSetPersistentData failed LE = 87
    EwfMgrCheckpoint failed LE = 87
    EwfMgrRestore failed LE = 87
    EwfMgrEnable succeeded
    EwfMgrDisable failed LE = 87
    EwfMgrCommit failed LE = 87
    EwfMgrSetLevel failed LE = 87
    EwfMgrClearCommand succeeded
    EwfMgrSetPersistentData failed LE = 87
    EwfMgrCheckpoint failed LE = 87
    EwfMgrRestore succeeded
    EwfMgrEnable failed LE = 87
    EwfMgrDisable succeeded
    EwfMgrCommit succeeded
    EwfMgrSetLevel failed LE = 87
    EwfMgrClearCommand succeeded
    EwfMgrOpenOverlayStore failed LE = 3
    EwfMgrOpenOverlayStore failed LE = 3

     



    • Edited by wcoder Friday, December 2, 2011 10:25 AM
    • Marked as answer by wcoder Wednesday, December 7, 2011 1:35 PM
    Friday, November 25, 2011 8:52 AM

All replies

  • If you run EWFMGR, do you get any errors?

    -Sean


    www.sjjmicro.com / www.seanliming.com / www.annabooks.com, Book Author - Pro Guide to WES 7, XP Embedded Advanced, Pro Guide to POS for .NET
    Friday, November 25, 2011 7:36 AM
    Moderator
  • Update : 02 dec 2011

    Thanks for reply,

    EWFMGR work for enabling or disabling volume protection and HORM...

    I Use the ICE\Win7e with SP1 and I test with or without fix for EWF available on ice on VM and pad device.

    I Build with ice a full OS + EWF

    I compile the EWF MSDN samplefrom : http://msdn.microsoft.com/en-us/library/ms912855%28v=winembedded.5%29.aspx

    The sample indicate that a lot of function failed :

     

    Ewf API Sample

    EwfMgrOpenOverlayStore failed LE = 3
    ?: = \\?\storage#volume#{441b619f-0ec8-11e1-92d9-806e6f6e6963}#0000000000100000#{68ebf3a0-82df-4f8a-b6d3-bd5dde13b313}


    --------------------------------------------------------
    -- Ewf protected volume configuration                  
    --------------------------------------------------------

    TYPE      : EWF_RAM_REG
    STATE     : EWF_DISABLED
    BOOT CMD  : EWF_NO_CMD     Param1 = 0  Param2 = 0

    0000000000000000000000000000000000000000000000000000000000000000

    Maximum Levels   : 1
    Clump Size       : 512 Bytes
    Current Level    : 0
    Ram Data Size    : 0 Bytes
    Memory Map Size  : 0 Bytes

    Device Name      : \Device\HarddiskVolume1
    Volume ID        : C83A7E10000010000000000000000000
    DEVC Drive:  ?



    C: = \\?\storage#volume#{441b619f-0ec8-11e1-92d9-806e6f6e6963}#0000000006500000#{68ebf3a0-82df-4f8a-b6d3-bd5dde13b313}


    --------------------------------------------------------
    -- Ewf protected volume configuration                  
    --------------------------------------------------------

    TYPE      : EWF_RAM_REG
    STATE     : EWF_ENABLED
    BOOT CMD  : EWF_NO_CMD     Param1 = 0  Param2 = 0

    0000000000000000000000000000000000000000000000000000000000000000

    Maximum Levels   : 1
    Clump Size       : 512 Bytes
    Current Level    : 1
    Ram Data Size    : 423167488 Bytes
    Memory Map Size  : 126976 Bytes

    Device Name      : \Device\HarddiskVolume2
    Volume ID        : C83A7E10000050060000000000000000
    DEVC Drive:  ?



    EwfMgrSetPersistentData failed LE = 87
    EwfMgrCheckpoint failed LE = 87
    EwfMgrRestore failed LE = 87
    EwfMgrEnable succeeded
    EwfMgrDisable failed LE = 87
    EwfMgrCommit failed LE = 87
    EwfMgrSetLevel failed LE = 87
    EwfMgrClearCommand succeeded
    EwfMgrSetPersistentData failed LE = 87
    EwfMgrCheckpoint failed LE = 87
    EwfMgrRestore succeeded
    EwfMgrEnable failed LE = 87
    EwfMgrDisable succeeded
    EwfMgrCommit succeeded
    EwfMgrSetLevel failed LE = 87
    EwfMgrClearCommand succeeded
    EwfMgrOpenOverlayStore failed LE = 3
    EwfMgrOpenOverlayStore failed LE = 3

     



    • Edited by wcoder Friday, December 2, 2011 10:25 AM
    • Marked as answer by wcoder Wednesday, December 7, 2011 1:35 PM
    Friday, November 25, 2011 8:52 AM