RAM (Reg) - Failed getting protected volume configuration with error 1 incorrect function. / Unable to find an EWF volume. RRS feed

  • Question

  • What exactly does this set of errors message mean?  I have a build that I am working with that has been fine for a long time.  Now whenever the image is reproduced (even from the save file with no changes), I get this error message after boot up.   

    EWF RAM-Reg mode, WES 2009.  Single SATA Disk on Module (C: Drive), DVD-ROM (D: drive).  The build is created, then copied to the SATA drive on a WinXP system.   The drive is then transferred to the target hardware.  FBA runs with EWF off and System Cloning set to Manual.  I make some needed changes to the configuration and then turn on EWF and then FBRseal with power off.  Then the install is put into an SDI which is incorporated into a final image that gets installed.  Please note again: this procedure has worked for a long time.  Now some changes are needed and we need to be able to deploy a new working image.  I noticed the failure and backtracked configuration/settings/etc. without success.  So then I tried to re-create the original image without changes and that failed as well.

    I have already tried the rundll32.exe ewfdll.dll,ConfigureEwf command to no avail (during initial post-FBA configuration).  If the system is rebooted, EWF starts working...BUT we have to have it working on that FIRST BOOT after cloning.  The "reboot fix" is not an option, nor is changing to another type of write filter.

    The only thing that I have not tried yet is to redo the .pmq file for import.  Is it possible that there was a different number of HDs connected at the time that TAP.exe was run and this is the cause?  Is it possibly related to the disk size?  It is a 300-400 MB image on a 1GB module.

    When I run "ewfmgr c:" I get "Failed getting protected volume configuration with error 1 incorrect function".  When I run just "ewfmgr" I get "Unable to find an EWF volume".  Another thing I noticed is that with the working copy, FBReseal on the cloned disks runs in 4-5 seconds.  With the failed builds it takes 10-13 seconds.  So I can tell even before the system is fully booted if it is correct or not just by watching the FBReseal screen.  If I reboot, the EWF volume is active but FBRseal does not run at all.

    Please do not read this sentence. Please ignore the previous sentence.

    Monday, November 23, 2015 10:34 PM

All replies

  • Unfortunately I cannot tell exactly what the problem is. But memories came up when reading about the behaviour. There was a very old problem with FBA/EWF which could be fixed by following registry setting - must be set before running fbreseal:

    Path:   HKLM\SYSTEM\ControlSet001\Control\WindowsEmbedded\FBA\4293xxxxxx
    Key:    FBAWasHere
    Typ:    REG_DWORD
    Value:  0
    Monday, November 30, 2015 8:20 AM
  • Does anyone know specifically what this error message refers to?  I have narrowed it down to something to do with the SDI file.  It is very unlikely that this is a configuration/setting/component issue.  Knowing what this cryptic error message means could help a lot toward figuring out the problem.

    Please do not read this sentence. Please ignore the previous sentence.

    Thursday, December 3, 2015 10:58 PM
  • Even the EWF RAM-REG needs a small partition space for the EWF volume ~32KB. You may not have capture the EWF Volume with the SDI file. Even if you have run the  rundll32.exe ewfdll.dll,ConfigureEwf, you need unpartitioned space on the disk to create the EWF volume.

    Sean Liming - Book Author: Starter Guide SIM (WEI), Pro Guide to WE8S & WES 7, Pro Guide to POS for .NET - /

    Friday, December 4, 2015 3:51 AM
  • There is 49 MB of unpartitioned space on the disk.  The SDI file works if nothing is done to it.  But if I simply extract the OS files from the SDI and then make a new SDI, it fails.

    Please do not read this sentence. Please ignore the previous sentence.

    Monday, December 7, 2015 5:24 PM