EwfMgrCommitFile fails to commit single file

  • Thread starter Thread starter aslan.kukunyants
  • Start date Start date
A

aslan.kukunyants

Hi everyone. I am trying to implement EWF API EwfMgrCommitFile().
I have already implemented some interfaces successfully, but
EwfMgrCommitFile() would not work.

I am aware of limitations and ok with it.

My current system x86, ntfs and I am using EWF RAM mode.

Here is my code:


int EWFcommitSingleFile(){

HANDLE hDisk;
WCHAR szDrive[20];
DWORD dwStatus = ERROR_SUCCESS;
BOOL bResult =FALSE;
LPWSTR lpwFileName;

lpwFileName = new WCHAR[150];
swprintf( lpwFileName, 150, L"%s", L"C:\\Program
Files\\tempfile.txt" );

hDisk = EwfMgrOpenProtected(szDrive);

if (INVALID_HANDLE_VALUE == hDisk) {
wprintf(L"Invalid Handle. Please make sure that the drive
exists H \n");
delete [] lpwFileName;
return -1;
}
bResult = EwfMgrCommitFile(hDisk,lpwFileName);

if (!bResult){
dwStatus = GetLastError();
wprintf(L"EwfCommit File failed LE = %u\n",dwStatus);
EwfMgrClose(hDisk);
delete [] lpwFileName;
return -1;
}
wprintf(L"EWF File Commited - ");
wprintf(L"Reboot system for change to take effect\n");
EwfMgrClose(hDisk);
delete [] lpwFileName;

return 0;
}



The error I get:
Failed with code: 123
Which is: ERROR_INVALID_NAME
The filename, directory name, or volume label syntax is incorrect.

What do I do wrong? Any help is appreciated.
 
Yes it does. Here are my steps:
1. build image with EWF RAM base option ( with disabled on start)
2. Run image from PreFBA to PostFBA
3. Once in the XPE OS, install custom apps
4. Perform System cloning (fbreseal.exe). Restart
5. Run: rundll32 ewfdll.dll ConfigureEwf to create volume. Restart
6. Type ewfmgr C: to ensure it is RAM base and it is disabled.
7. Copy my sample app ( this app ustilizing some EWF API's including
EwfMgrCommitFile) to C: drive
8. Create tempfile.txt in C:\Program Files
9. Enable ewf (enable and disable is done thru the app) restart machine
10. Veryfie EWF si enabled (using command line or with my app)
11. Execute EwfMgrCommitFile() and get this error.

All other API's that i have implemeted are working ok

Thank you
-Aslan
The file has to already exist in the protected volume for this API to work.
Does the file already exist?

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit




Hi everyone. I am trying to implement EWF API EwfMgrCommitFile().
I have already implemented some interfaces successfully, but
EwfMgrCommitFile() would not work.

I am aware of limitations and ok with it.

My current system x86, ntfs and I am using EWF RAM mode.

Here is my code:


int EWFcommitSingleFile(){

HANDLE hDisk;
WCHAR szDrive[20];
DWORD dwStatus = ERROR_SUCCESS;
BOOL bResult =FALSE;
LPWSTR lpwFileName;

lpwFileName = new WCHAR[150];
swprintf( lpwFileName, 150, L"%s", L"C:\\Program
Files\\tempfile.txt" );

hDisk = EwfMgrOpenProtected(szDrive);

if (INVALID_HANDLE_VALUE == hDisk) {
wprintf(L"Invalid Handle. Please make sure that the drive
exists H \n");
delete [] lpwFileName;
return -1;
}
bResult = EwfMgrCommitFile(hDisk,lpwFileName);

if (!bResult){
dwStatus = GetLastError();
wprintf(L"EwfCommit File failed LE = %u\n",dwStatus);
EwfMgrClose(hDisk);
delete [] lpwFileName;
return -1;
}
wprintf(L"EWF File Commited - ");
wprintf(L"Reboot system for change to take effect\n");
EwfMgrClose(hDisk);
delete [] lpwFileName;

return 0;
}



The error I get:
Failed with code: 123
Which is: ERROR_INVALID_NAME
The filename, directory name, or volume label syntax is incorrect.

What do I do wrong? Any help is appreciated.
Click to expand...
Click to expand...
 
My question is, has anyone ever sucessfully implemented this api. I
have searched entire MSDN and could not find one example, and most of
the related articles/forums i found had the same issue and none on how
to fix it.
Yes it does. Here are my steps:
1. build image with EWF RAM base option ( with disabled on start)
2. Run image from PreFBA to PostFBA
3. Once in the XPE OS, install custom apps
4. Perform System cloning (fbreseal.exe). Restart
5. Run: rundll32 ewfdll.dll ConfigureEwf to create volume. Restart
6. Type ewfmgr C: to ensure it is RAM base and it is disabled.
7. Copy my sample app ( this app ustilizing some EWF API's including
EwfMgrCommitFile) to C: drive
8. Create tempfile.txt in C:\Program Files
9. Enable ewf (enable and disable is done thru the app) restart machine
10. Veryfie EWF si enabled (using command line or with my app)
11. Execute EwfMgrCommitFile() and get this error.

All other API's that i have implemeted are working ok

Thank you
-Aslan
The file has to already exist in the protected volume for this API to work.
Does the file already exist?

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit




Hi everyone. I am trying to implement EWF API EwfMgrCommitFile().
I have already implemented some interfaces successfully, but
EwfMgrCommitFile() would not work.

I am aware of limitations and ok with it.

My current system x86, ntfs and I am using EWF RAM mode.

Here is my code:


int EWFcommitSingleFile(){

HANDLE hDisk;
WCHAR szDrive[20];
DWORD dwStatus = ERROR_SUCCESS;
BOOL bResult =FALSE;
LPWSTR lpwFileName;

lpwFileName = new WCHAR[150];
swprintf( lpwFileName, 150, L"%s", L"C:\\Program
Files\\tempfile.txt" );

hDisk = EwfMgrOpenProtected(szDrive);

if (INVALID_HANDLE_VALUE == hDisk) {
wprintf(L"Invalid Handle. Please make sure that the drive
exists H \n");
delete [] lpwFileName;
return -1;
}
bResult = EwfMgrCommitFile(hDisk,lpwFileName);

if (!bResult){
dwStatus = GetLastError();
wprintf(L"EwfCommit File failed LE = %u\n",dwStatus);
EwfMgrClose(hDisk);
delete [] lpwFileName;
return -1;
}
wprintf(L"EWF File Commited - ");
wprintf(L"Reboot system for change to take effect\n");
EwfMgrClose(hDisk);
delete [] lpwFileName;

return 0;
}



The error I get:
Failed with code: 123
Which is: ERROR_INVALID_NAME
The filename, directory name, or volume label syntax is incorrect.

What do I do wrong? Any help is appreciated.
Click to expand...
Click to expand...
Click to expand...
 
In case if anyone wondering, i have rceived very quick responce from
Microsoft team.

Hi Aslan,

I asked the dev to look at this and here's his response.

Thank you, Andy

1. You have to pass a "root-relative-path" to commit command. The
syntax for the file name should exclude "c:". i.e. "temp\test.txt"
works and "c:\temp\test.txt" does not.

2. If the directory name has a space in it, the command does not work
and returns the following error "3: The system cannot find the path
specified".

3. Commit command changes the file on the protected volume immediately.
No reboot is required for change to take effect.

Thank you Andy and Matt

My question is, has anyone ever sucessfully implemented this api. I
have searched entire MSDN and could not find one example, and most of
the related articles/forums i found had the same issue and none on how
to fix it.
Yes it does. Here are my steps:
1. build image with EWF RAM base option ( with disabled on start)
2. Run image from PreFBA to PostFBA
3. Once in the XPE OS, install custom apps
4. Perform System cloning (fbreseal.exe). Restart
5. Run: rundll32 ewfdll.dll ConfigureEwf to create volume. Restart
6. Type ewfmgr C: to ensure it is RAM base and it is disabled.
7. Copy my sample app ( this app ustilizing some EWF API's including
EwfMgrCommitFile) to C: drive
8. Create tempfile.txt in C:\Program Files
9. Enable ewf (enable and disable is done thru the app) restart machine
10. Veryfie EWF si enabled (using command line or with my app)
11. Execute EwfMgrCommitFile() and get this error.

All other API's that i have implemeted are working ok

Thank you
-Aslan
The file has to already exist in the protected volume for this API to work.
Does the file already exist?

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit




Hi everyone. I am trying to implement EWF API EwfMgrCommitFile().
I have already implemented some interfaces successfully, but
EwfMgrCommitFile() would not work.

I am aware of limitations and ok with it.

My current system x86, ntfs and I am using EWF RAM mode.

Here is my code:


int EWFcommitSingleFile(){

HANDLE hDisk;
WCHAR szDrive[20];
DWORD dwStatus = ERROR_SUCCESS;
BOOL bResult =FALSE;
LPWSTR lpwFileName;

lpwFileName = new WCHAR[150];
swprintf( lpwFileName, 150, L"%s", L"C:\\Program
Files\\tempfile.txt" );

hDisk = EwfMgrOpenProtected(szDrive);

if (INVALID_HANDLE_VALUE == hDisk) {
wprintf(L"Invalid Handle. Please make sure that the drive
exists H \n");
delete [] lpwFileName;
return -1;
}
bResult = EwfMgrCommitFile(hDisk,lpwFileName);

if (!bResult){
dwStatus = GetLastError();
wprintf(L"EwfCommit File failed LE = %u\n",dwStatus);
EwfMgrClose(hDisk);
delete [] lpwFileName;
return -1;
}
wprintf(L"EWF File Commited - ");
wprintf(L"Reboot system for change to take effect\n");
EwfMgrClose(hDisk);
delete [] lpwFileName;

return 0;
}



The error I get:
Failed with code: 123
Which is: ERROR_INVALID_NAME
The filename, directory name, or volume label syntax is incorrect.

What do I do wrong? Any help is appreciated.
Click to expand...
Click to expand...
Click to expand...
 
Back
Top