EWF RAM Reg with two drives

[lee]

I'm trying to get XP Embedded to protect my C: and D: drives with RAM
Reg mode. I'm using XPe SP1. I can get EWF to protect my C: drive,
but cannot figure out how to get the D: drive protected.

I followed the MSDN "tutorial"
(http://msdn.microsoft.com/library/d...en-us/xpehelp/html/xegrfEWFRAMRegOverlays.asp)
but that didn't work.

Here's my current setup:
* [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ewf]
** "ErrorControl" == 1
** "Group" == "System Bus Extender"
** "Start" == 0
** "Type" == 1

*
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
** "UpperFilters" == "Ewf volsnap"

*
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{1EA414D1-6760-4625-8CBE-4F9F85A48E15}]
** "UpperFilters" == "Ewf volsnap"

*
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
** "VolumeID" == "{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
** "Type" == 1
** "ArcName" == "multi(0)disk(0)rdisk(0)partition(1)"

*
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume1]
** "VolumeID" == "{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
** "Type" == 1
** "ArcName" == "multi(0)disk(0)rdisk(0)partition(2)"

I configured EWF in the TD to use "RAM", have a size of "0", use a
"SCSI" device, unchecked "Start EWF Enabled", and disabled "FBA DLL/COM
Registration". If I look at fbalog.txt, there is no mention of "EWF"

Should the VolumeID be the same for both partitions?

I'm sure this has been done before, but I can't seem to find any
documentation about it.

Thanks for any help!
John

 

[Slobodan Brcin \(eMVP\)]

Hi Lee,

Try using ewf driver from XPe SP2 since I think that only there is included support for 2 partition protection from REG RAM EWF.

Volume ID should be same.
And you miss Enabled entries.

What do you get if you type ewfmgr C: ewmgrd D:?

Regards,
Slobodan