EWF error code 5 following reboot RRS feed

  • Question

  • Hi

    I am using WES7 64bit on an i7 with an SSD that has 2 partitions, where C: is protected by EWF and D: is not protected. EWF is using RAM-REG.

    The system was working well, I was able to enable or disable EWF and reboot to confirm the correct operation of EWF.

    Then I experienced a problem. I used the following commands to turn on EWF and reboot:

    ewfmgr c: enable

    shutdown -r -f -t 0

    After the reboot I used the following command to check EWF status:

    ewfmgr c:

    The reply was:

    Failed opening the target device \\.\c: with error 5

    Access is denied

    Using this command prior to the reboot did not produce this error message. As an experiment I repeated the command using cmd.exe started with Run as Administrator, the command worked without producing the error message, however the EWF was not enabled as expected.

    Something has gone wrong. It is as if enabling EWF failed and a side effect of this was to downgrade the access rights of my user account from admin to lower than admin.

    Other parts of the system now appear to be broken. For example if I click on "Change User Account Control Settings" in the User Accounts section of the Control Panel, I do not get the usual Settings Window, instead a blank window breifly opens and the closes.

    Please can you suggest what has gone wrong with my system following the attempt to enable EWF?


    Thursday, June 13, 2013 3:21 PM

All replies

  • Could the flash disk been corrupted?

    Try typing ewfmgr c: before enabling EWF and see what happens. To enabled you need - or / before enable. then just do a shutdown -r -t 0. Don't force anything to shutdown. / / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Thursday, June 13, 2013 5:00 PM