Way to Alter EWF RAM Config after boot?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hey Guys-

I'm trying to use a fairly universal image for several different devices. I
want to use EWF RAM based overlay.
The problem is that on one device the protected drive is actually disk 0,
the only device. However on the second device the protected drive is
actually disk 2 since its a scsi array.

I've read a little about EWF Ram Reg, maybe this is a better option?

Is there a way to configure this easily post FBA?
 
Hi Mark,

I'm definitely not the EWF guru, you'll have to wait for Slobodan or KM to
follow up, but.....

There are 4 main registry entries that I concern myself with while working
with a registry based EWF RAM configuration. They are:

SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\Type -
Dword set to "1"
SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\ArcName -
String set to "multi(0)disk(0)rdisk(0)partition(1)" (or whatever the arc
path is that you need)
SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\Enabled -
Dword set to "0" (Ensures startup is disabled)
SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\UpperFilters
- Multi-String set to "EWF" to add EWF to the list of upper filter drivers

In your "all in one" configuration follow the steps to create a registry
based EWF RAM configuration:
http://msdn.microsoft.com/library/d...lp/html/xegrfconfiguringewframregoverlays.asp

What I did was to create a component that includes the above registry data
and added that to any builds that needed EWF RAM. I wrote a little utility
that modifies the registry data (To enable or disable) and runs
a -commitanddisable (if previously enabled) to commit the changes and then
reboots. This can be done from an application, a script using reg.exe, or by
hand via registry editor.

Hopefully that will get you started. Let us know if you have more questions.

HTH,
Brad
 
I had a similar problem where an part of an image was to be deployed onto a CF
card or a hard-drive. I found that the simplest solution was to configure EWF
in TD so that it was disabled by default and setup an FBA RunOnce action to
execute a script that configured the EWF registry settings the way I wanted.
After running the image thru FBA I manually verified the settings and then
enabled EWF.

David
 
David said:
I had a similar problem where an part of an image was to be deployed onto a CF
card or a hard-drive. I found that the simplest solution was to configure EWF
in TD so that it was disabled by default and setup an FBA RunOnce action to
execute a script that configured the EWF registry settings the way I wanted.
After running the image thru FBA I manually verified the settings and then
enabled EWF.

David
Click to expand...

All -

I have the registry items you speak of and EWF is started disabled.

Though, I am little confused right now.

My arcpath is set to..
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"

I thought that would be right since in my boot ini file it says
multi(0)disk(0)rdisk(0)partition(1) for my C: drive which is the one I
want to protect.

However, when I run ewfmgr it shows D: as my protected volume.

I was unsure what to change it to. Under the disk management service it
labels my boot disk as disk 2 so I tried...
"ArcName"="multi(0)disk(2)rdisk(0)partition(1)" and that produced a STOP
7B BSOD.


I'm at a little bit of a loss. I expect something like this..

-Disable ewf. ewfmgr -disable
-Change some registry entries (Which ones?)
-reboot
-Enable ewf. ewfmgr -disable
-Reboot


David... Is it possible for you to upload your script or at least the
meat of it so I could see what I really need to do?

Any other help/guidance is appreciated.
 
Mark said:
All -

I have the registry items you speak of and EWF is started disabled.

Though, I am little confused right now.

My arcpath is set to..
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"

I thought that would be right since in my boot ini file it says
multi(0)disk(0)rdisk(0)partition(1) for my C: drive which is the one I want to
protect.

However, when I run ewfmgr it shows D: as my protected volume.

I was unsure what to change it to. Under the disk management service it
labels my boot disk as disk 2 so I tried...
"ArcName"="multi(0)disk(2)rdisk(0)partition(1)" and that produced a STOP 7B
BSOD.


I'm at a little bit of a loss. I expect something like this..

-Disable ewf. ewfmgr -disable
-Change some registry entries (Which ones?)
-reboot
-Enable ewf. ewfmgr -disable
-Reboot


David... Is it possible for you to upload your script or at least the meat of
it so I could see what I really need to do?

Any other help/guidance is appreciated.
Click to expand...


From your reply it seems like you may have two partitions on the same disk, or
two physical disk drives. What is the actual disk/partition layout you are
using and where is the boot partition.

Are you copying the post-FBA image to a different drive (or partition layout)
from that used to run it thru FBA. If you do that then the EWF settings may be
invalid for the new layout.

Are you using the BIOS to change the boot drive (e.g. boot from disk 2 instead
of disk 1). If you are doing that then the arc path in boot.ini may not match
the setting you need to put into the EWF registry settings. Normally all you
need to do is to make sure that the EWF setting is the same as that in the
ARC-path settings in target designer.

How many entries does the
HLKM\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\UpperFilters
Multi-String have in it. Normally there should be two settings in this string
once EWF has been correctly configured at run-time. If EWF is the only entry
then I have seen odd problems occur in some builds. If you are adding this
registry entry in TD or a component then make sure that the 'Advanced
Properties' for the entry indicate that the 'Write Options' setting is 'Always
Edit The Value'.
 
David said:
From your reply it seems like you may have two partitions on the same disk, or
two physical disk drives. What is the actual disk/partition layout you are
using and where is the boot partition.

Are you copying the post-FBA image to a different drive (or partition layout)
from that used to run it thru FBA. If you do that then the EWF settings may be
invalid for the new layout.

Are you using the BIOS to change the boot drive (e.g. boot from disk 2 instead
of disk 1). If you are doing that then the arc path in boot.ini may not match
the setting you need to put into the EWF registry settings. Normally all you
need to do is to make sure that the EWF setting is the same as that in the
ARC-path settings in target designer.

How many entries does the
HLKM\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\UpperFilters
Multi-String have in it. Normally there should be two settings in this string
once EWF has been correctly configured at run-time. If EWF is the only entry
then I have seen odd problems occur in some builds. If you are adding this
registry entry in TD or a component then make sure that the 'Advanced
Properties' for the entry indicate that the 'Write Options' setting is 'Always
Edit The Value'.
Click to expand...
David-

The problem lies in that there are two types of machines that have
identical configuration with the exception that Machine A has 3 physical
hard disks and Machine B has 2 physical hard disks.
So what we have is....

Machine A
Disk 0 (Unused 36gb SCSI Disk, E:)
Disk 1 (Backup Storage, 36GB SCSI Disk, D:)
Disk 2 (Solid State Media Disk, SCSI, Contains Boot partition, Image
Resides Here, C:)

Machine B
Disk 0 (Backup Storage, 36GB SCSI Disk, D:)
Disk 1 (Solid State Media Disk, SCSI, Contains Boot partition, Image
Resides Here, C:)

Ok so here's the problem, two identical machines, with the simple diff
that there are 2 Physical disks in machine b and 3 in machine a.

The problem presents itself that I don't want to have to rebuild an
image for a simple diff like that. So what I was wondering was....

Am I able to just set it static like on Disk 1, and make a script to
alter it on Machine A, to change to disk 2?


I don't copy any post FBA image. I copy the runtime and run through FBA
on each machine. I don't recapture any images.


I'm not using the BIOS or SCSI config utility to alter the drive letters
or disk ordering.


Like I said, I just want to be able to alter which partition is
protected, post FBA. I don't know which registry settings or commands I
should be using to achieve this.


Thanks for your thorough response.

-Mark
 
Mark said:
David-

The problem lies in that there are two types of machines that have identical
configuration with the exception that Machine A has 3 physical hard disks and
Machine B has 2 physical hard disks.
So what we have is....

Machine A
Disk 0 (Unused 36gb SCSI Disk, E:)
Disk 1 (Backup Storage, 36GB SCSI Disk, D:)
Disk 2 (Solid State Media Disk, SCSI, Contains Boot partition, Image Resides
Here, C:)

Machine B
Disk 0 (Backup Storage, 36GB SCSI Disk, D:)
Disk 1 (Solid State Media Disk, SCSI, Contains Boot partition, Image Resides
Here, C:)

Ok so here's the problem, two identical machines, with the simple diff that
there are 2 Physical disks in machine b and 3 in machine a.

The problem presents itself that I don't want to have to rebuild an image for
a simple diff like that. So what I was wondering was....

Am I able to just set it static like on Disk 1, and make a script to alter it
on Machine A, to change to disk 2?


I don't copy any post FBA image. I copy the runtime and run through FBA on
each machine. I don't recapture any images.


I'm not using the BIOS or SCSI config utility to alter the drive letters or
disk ordering.


Like I said, I just want to be able to alter which partition is protected,
post FBA. I don't know which registry settings or commands I should be using
to achieve this.


Thanks for your thorough response.

-Mark
Click to expand...

Mark

I have never used XP with SCSI disks, but I think from your descriptions that
EWF works correctly when the single image is deployed on Machine type B but has
problems on Machine type A. If that is the case you have two options...

1) Reorganise the disk layout on machine A so that it matches machine B (i.e.
move the existing disk0 to disk2). That should allow a single EWF configuration
to work on both layouts without any need for run-time modification.

2) Modify the EWF setting to match the new position of the boot disk (disk 2
instead of disk 1). To do that you will need to modify the
HKLM\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\ArcName
setting so that it points to the correct drive. The setting for that will
probably be either "multi(?)disk(+1)rdisk(?)partition(?)" or
"multi(+1)disk(?)rdisk(?)partition(?)". Simple off-line changes to the registry
will allow you to find the correct setting without the need to run through FBA
each time.

For more information about ARC paths see ...
http://msdn.microsoft.com/library/d...XPE_DUALBOOTDual-BootingTipsForXPEmbedded.asp
or
http://msdn.microsoft.com/library/d...oyingEWF-ProtectedRun-TimeImageToNewMedia.asp

David
 
Back
Top