EWF RAM Reg mode after copying files to CF card

[Thomas Johansen]

Hi

I run FBA on af harddisk, with EWF RAM mode. It wotks fine. The EWF volume
is created. Then I run "etprep -delete" to delete the EWF volume.
I then copy the files to the first partition on the CF card.(The CF card is
not marked as removable). The rest of the CF card (100 MB) is located in at
extended partition.
When I then boot from the CF card, EWF runs in RAM Reg mode. It has not
created any EWF volume of the CF card.
I try to run the "rundll32 Ewfdll.dll ConfigureEwf", but I get an error
about it could not load some modules ?
Allso i I run "ewfmgr": it say that no EWF volume was found.
The protected volume works fine, but I really want the EWF volume to be
created and I want to use my CF card with the EWF volume !!!

Any idea what I have been missing. Reading MS help or other posts in this
group havn't helped me ??

There are no errors during FBA when the EWF volume is created the first time
!!

/Thomas

 

[Slobodan Brcin \(eMVP\)]

Thomas,

Make sure that:
1. Your CF is marked as fixed.
2. That you have only primary partitions.
3. That you have at least few MB at the end of disk empty (64 KB should be
enough, but you never know how partitioning will work)
4. Send us the exact error reported by ConfigureEwf.

Regards,
Slobodan

 

[Thomas Johansen]

Hi again

I now did exactly what you described below, and now it works (sort of). I
did have 1 primary partition and 1 extended. Its probally why I did not
create an EWF volume. But now it seems that there is another problem. The
load of kernel modules takes a long time now, 2 - 3 sec for every module.
(Using the /sos switch in boot.ini). It didn't when running EWF RAM reg
mode?

Here is step by step what I am doing:

-The CF card is markes as fixed.
-There is now 2 primary partitions:
-The first partition is a primary, its active, formated with FAT32 and is
about 702,8 MB in size
-The next is 282,5 MB, using FAT32 and its not active
-The last 2 MB is unpartitioned and is located in the end
-I then copy the XPe files to the CF card (bootprep has been run on it)
-The I boot the CF card.
-I run with the /SOS switch in the boot.ini and every
"multi(0).disk(0).rdisk(0).partition(1)\Windows\.................." takes
about 2-3 sec. to complete. ??? Allso when booting from the HD.. !!!
-The rest of the boot process seems to be OK.
-The I run the following commands:

C:\Documents and Settings\Administrator>ewfmgr
The Ewf Volume is "\Device\HarddiskVolume3"
Ewf Volume Configuration
Volume Size 64512
Segments 0
Segment Size 0
Free segments 0
Max Levels 1
Max Protected Volumes 1
Protected Volumes 1

Ewf Volume percent full -1.#J

Protected volumes
Device Name "\Device\HarddiskVolume1" [C:]

C:\Documents and Settings\Administrator>ewfmgr c:
Protected Volume Configuration
Type RAM
State DISABLED
Boot Command NO_CMD
Param1 0
Param2 0
Persistent Data ""
Volume ID F2 21 0A 0E 00 7E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level 1

Memory used for data 0 bytes
Memory used for mapping 0 bytes

1: So the EWF seems now to run fine exept from the slow load of kernel
modules ??
2: Is it possible to have a primary partition, 1 extendend and after that a
primary partition for the EWF volume ??
3: I created a new texst file and then ran "ewfmgr c: -commit". The I
created a new text file and rebooted Windows. After restart both files still
where there ?
Does a restart of WindowsXPe result in a "ewfmgr c: -commit" or why did
I see this behavior ??

/ Thomas

 

[KM]

Thomas,

-The CF card is markes as fixed.
-There is now 2 primary partitions:
-The first partition is a primary, its active, formated with FAT32 and is
about 702,8 MB in size
-The next is 282,5 MB, using FAT32 and its not active
-The last 2 MB is unpartitioned and is located in the end
-I then copy the XPe files to the CF card (bootprep has been run on it)
-The I boot the CF card.
-I run with the /SOS switch in the boot.ini and every
"multi(0).disk(0).rdisk(0).partition(1)\Windows\.................." takes
about 2-3 sec. to complete. ??? Allso when booting from the HD.. !!!

This is unlikely EWF related.
Have you ever tested the file read/write ops on the CF card?
E.g., if you install XP Pro on it (minimum config) how does it work?

-The rest of the boot process seems to be OK.
-The I run the following commands: ....
1: So the EWF seems now to run fine exept from the slow load of kernel modules ??

Any chance for you to use BootVis tool to analyze why the boot is slow?

Also, add /bootlog switch to your boot.ini and post the result %SystemRoot%\Ntbtlog.txt file here.

2: Is it possible to have a primary partition, 1 extendend and after that a
primary partition for the EWF volume ??

You don't have much of the control there where the Config partition is created since it is covered by EWF driver.
However, with EWF RAM Reg mode you can eliminate the creation of the EWF Config patition at all (especially on CF).
Do you really need EWF RAM mode? If so, why?

3: I created a new texst file and then ran "ewfmgr c: -commit". The I
created a new text file and rebooted Windows. After restart both files still where there ?

According to the output of ewfmgr c: command you showed earlier, the EWF is disabled for C: volume on your system. Did you enable
it?

Does a restart of WindowsXPe result in a "ewfmgr c: -commit" or why did
I see this behavior ??

You need a graceful shotdown/reboot for the system in order to commit the data. How do you do the reboot now? And what's your image
is based on - Minlogon/Winlogod, SP1/SP2?

 

[Thomas Johansen]

This is unlikely EWF related.

Have you ever tested the file read/write ops on the CF card?
E.g., if you install XP Pro on it (minimum config) how does it work?

I have no located what coursed this. If I use Partition Magic 6.0 to do the
partitioning of the CF or HD I get this slow boot behavior. But when I use
fdisk.exe todo the samme partitioning I don't get this error. For me it do
not give much sense, but now I know what I has todo to solve this. Thats
enough for me right now

modules ??

Any chance for you to use BootVis tool to analyze why the boot is slow?

Also, add /bootlog switch to your boot.ini and post the result

%SystemRoot%\Ntbtlog.txt file here.

Fixed now, so no need

You don't have much of the control there where the Config partition is

created since it is covered by EWF driver.

However, with EWF RAM Reg mode you can eliminate the creation of the EWF

Config patition at all (especially on CF).

Do you really need EWF RAM mode? If so, why?

I don't now ? Right now I'm just toying with EWF to se how it works. The
only diffrence between RAM Reg mode and RAM mode, is that any changes to the
EWF configuration must be done with a "-commitanddisable" switch and thereby
the need for 2 reboot ?? Or im I wrong here ?

still where there ?

According to the output of ewfmgr c: command you showed earlier, the EWF

is disabled for C: volume on your system. Did you enable

it?

Yes.. It works fine

You need a graceful shotdown/reboot for the system in order to commit the

data. How do you do the reboot now? And what's your image

is based on - Minlogon/Winlogod, SP1/SP2?

Its SP1 with Winlogon.

/Thomas

 

[Slobodan Brcin \(eMVP\)]

Thomas,

fdisk.exe todo the samme partitioning I don't get this error. For me it do
not give much sense, but now I know what I has todo to solve this.

It does not have sense I agree, but not all things related to computers can
be explained. (Well they could be but it would take some imaginary time to
do that)

I don't now ? Right now I'm just toying with EWF to se how it works. The
only diffrence between RAM Reg mode and RAM mode, is that any changes to
the
EWF configuration must be done with a "-commitanddisable" switch and
thereby
the need for 2 reboot ?? Or im I wrong here ?

Both -disable and -commitanddisable requre you to do one reboot. Operation
in first case is memorized in external config partition and data is disarded
during the reboot. In seocnd case operation is recorder in registry and
whole image changes from overlay are written to medium.

You have instant switch -commitanddisable - live in SP2 that allow you to
disable EWF without reboot.

still where there ?

Of course they were. EWF do commit only on gracefull system shutdown not
before. commit is only a flag that tell to EWF that it should commit image.

Its SP1 with Winlogon

Make sure that you use latest QFE for EWF.

Regards,
Slobodan