Share via

EWF Volume Configuration

  • Article

When EWF is configured during the First Boot Agent (FBA) process, it creates a small partition on the media. This partition is called the EWF volume. The EWF volume stores configuration information about all of the EWF-protected volumes on the device, including the number of protected volumes, protected volume sizes, and any of the overlay levels. Only one EWF volume is created on your device, regardless of how many disks are in the system.

The following list shows the EWF volume configuration requirements:

  • For EWF Disk mode, the EWF volume is typically less than 32 MB.
  • For EWF RAM mode, the EWF volume is less than 64 KB. The EWF volume for RAM-based overlays stores additional boot commands that are applied when the system reboots, for example, EWF enable and disable.
  • For EWF RAM Reg mode, the configuration information stored in the EWF volume is instead stored in the registry. RAM Reg modes are useful when you cannot create a new partition for the EWF volume.

During the First Boot Agent (FBA) phase, EWFdll.dll creates the EWF volume on your media. The EWF volume is created in one of the following two types of spaces on your media:

  • Immediately after a primary partition

    -or-

  • Within empty space in an extended partition

Note   If an extended partition is available on your system, EWF will always attempt to create the EWF volume within empty space in the extended partition, even if there is additional free space at the end of the disk. If you have an extended partition, ensure that there is space within the partition for the EWF volume.

Note   Disk overlays must be disabled prior to re-deploying a pre-FBA runtime on the drive. If they are not disabled, EWF will not be able to delete and re-create these EWF Volumes during FBA. If this step is missed then the error “missing or corrupt hal.dll” will be thrown during subsequent boots of the system.

Make sure that your media can support the creation of an EWF volume. Some media, such as CompactFlash devices that are marked as removable, do not allow the creation of new partitions. However, if the media is marked as fixed, you can create more than one partition on it. Some CompactFlash manufacturers supply utilities to mark the media as fixed. For more information, see CompactFlash.

Additionally, to prevent the operating system from changing drive letters that are assigned to existing volumes, use the following rule when you create the EWF volume: If an extended volume exists on the drive with enough space, the EWF volume is created as a logical volume. Otherwise, the EWF volume is created in a primary volume.

If you cannot create a new partition or change the partition structure of your media, consider implementing EWF RAM Reg mode. For more information, see EWF RAM Reg Mode.

After the FBA process finishes, you can check the status of the EWF volume in the FBALOG.txt file in the Windows\FBA directory. The EWF volume might not be created for a variety of reasons. The following list shows some of the more common problems when configuring the EWF volume:

  • There are already four primary partitions on the disk. Disks can have no more than four primary partitions.
  • There is no space immediately after the primary partition.
  • There is no space within the extended partition. The EWF volume cannot be created immediately after an extended partition.
  • There is an existing EWF volume that was not deleted.

See Also

EWF Performance Considerations | EWF Modes | Enhanced Write Filter API

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.