Registry EWF RAM Problems

  • Thread starter Thread starter Doug Gordon
  • Start date Start date
D

Doug Gordon

I am trying to switch to using the registry-based RAM EWF feature. I
installed Slobodan's "ewfram" component, but it doesn't seem to act as
documented.

First off, the instructions say to remove the standard "Enhanced Write
Filter" and "EWF API" components, but when I add the "EWF RAM" component and
do a dependency check, they are pulled right back in. So why remove them in
the first place?

Secondly, it says to change values in the Advanced Component Properties, but
there are no advanced properties of the EWF RAM component. These settings
are under the standard EWF component that was included by the dependency
checker, so I made the settings there.

After building, installing, and the FBA procedure, the RAM-based EWF is
working, but during FBA it actually went ahead and created the hidden EWF
partition on my disk and is using it, which is what I was trying to
eliminate.

Did I do something wrong or leave out a step here? If I manually disable the
"ewfinit.dll" file as suggested in the detailed manual instructions for this
feature, will that cause any problems during FBA? It certainly can't create
the partition without that DLL.

-- Doug G
 
Hi Doug,

Can you please disable auto-resolve dependencies and see which component is including the MS EWF components?
My component should be self contained and can't work in paralel with stadard EWF component since standard component affect FBA and
create hidden EWF config partition that you do not want.

What SP do you use?

I have posted components for both SP1 and SP2 as separate packages.

Regards,
Slobodan
 
Slobodan:
I'm using SP1 and am using your component that goes with that. I see now
that the 3rd-party component "ewftray" has the EWF API as a dependency, and
probably the EWF API pulls in the main EWF component. I'll leave ewftray out
for now and maybe modify it later.

But even with just your RAM EWF component installed, I don't see any of the
advanced settings for setting the EwfEnable or ProtectedPartitionArcName
values. Do I have to do this directly with registry settings?

Doug
 
Hi Doug,

EwfEnable is set to 0 by default and it should stay that way.
Also ARC name is used as default for first disk and first partition. You can
change that in properties or advanced properties IIRC. But on most images it
should work by default.

Regards,
Slobodan
 
Back
Top